Re: More freemail URI spam

2010-04-20 Thread Jonas Eckerman
On 2010-04-17 21:04, Alex wrote: Maybe someone knows of a list of all the URL shorteners to be used in a combo uri/meta rule? I very much doubt that you'll find a list of *all* the URL shorteners. New ones crops up all the time, and old ones disappears. Marc Perkel posted about a DNS based

Re: More freemail URI spam

2010-04-20 Thread Jonas Eckerman
On 2010-04-17 23:51, Alex wrote: Somebody on this list wrote a parser to actually parse shorteners to their obscured URLs. That would sure be great. I hadn't seen that, but would like to know more about it. Sounds like a better solution... That'd be me. It's a plugin called URLRedirect and

RE: More freemail URI spam

2010-04-20 Thread Rosenbaum, Larry M.
Generally speaking, anything deemed worthwhile is added to SA proper (unless there's a licensing question). The exceptions come from automated rules (like Sought, MBL, SARE 2tld, and Khop-sc-neighbors), 90_2tld.cf has been replaced by the official rule file 20_aux_tlds.cf. From the comments

Re: More freemail URI spam

2010-04-19 Thread Adam Katz
On 04/18/2010 11:15 PM, Alex wrote: Incidentally, are there other CustomRulesets that you think should or shouldn't be used? http://wiki.apache.org/spamassassin/CustomRulesets At the least, the Chickpox and backhair, by the same author, should noted on this page that they're no longer

Re: More freemail URI spam

2010-04-18 Thread Alex
Hi, Yes, big help. That did it, using the default scores. This was written a number of years ago. Do you think it's still safe to use the default scores? NO! I put some of the (previously) better-performing chickenpox rules into my sandbox a while ago to investigate this.  It's still

More freemail URI spam

2010-04-17 Thread Alex
Hi, I'm hoping someone can help me with a rule to catch URI spam variation from freemail domains: http://pastebin.com/SkrKykYj This one is another urlshortener. How is this class of redirection spam being stopped by everyone these days? I've tried to adapt the ones I have, but this is very

Re: More freemail URI spam

2010-04-17 Thread John Hardin
On Sat, 17 Apr 2010, Alex wrote: I'm hoping someone can help me with a rule to catch URI spam variation from freemail domains: http://pastebin.com/SkrKykYj You might want to look into the old Chickenpox rule. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/

Re: More freemail URI spam

2010-04-17 Thread Alex
Hi, http://pastebin.com/SkrKykYj You might want to look into the old Chickenpox rule. Yes, big help. That did it, using the default scores. This was written a number of years ago. Do you think it's still safe to use the default scores? I still wish I had a better grasp on regex so I could

Re: More freemail URI spam

2010-04-17 Thread John Hardin
On Sat, 17 Apr 2010, Alex wrote: http://pastebin.com/SkrKykYj You might want to look into the old Chickenpox rule. Yes, big help. That did it, using the default scores. This was written a number of years ago. Do you think it's still safe to use the default scores? I think the problems

Re: More freemail URI spam

2010-04-17 Thread Adam Katz
You might want to look into the old Chickenpox rule. On 04/17/2010 03:04 PM, Alex wrote: Yes, big help. That did it, using the default scores. This was written a number of years ago. Do you think it's still safe to use the default scores? NO! I put some of the (previously) better-performing

Re: More freemail URI spam

2010-04-17 Thread Alex
Hi, Yes, big help. That did it, using the default scores. This was written a number of years ago. Do you think it's still safe to use the default scores? NO! I put some of the (previously) better-performing chickenpox rules into my sandbox a while ago to investigate this.  It's still