------------------------------------- Giampaolo Tomassoni - I.T. Consultant Piazza VIII Aprile 1948, 4 I-53043 Chiusi (SI) - Italy Tel/Ph: +39-0578-21100
MAI mandare un messaggio a: NEVER send an e-mail to: [EMAIL PROTECTED] > Da: Chris Santerre [mailto:[EMAIL PROTECTED] > > > -----Original Message----- > > From: Giampaolo Tomassoni [mailto:[EMAIL PROTECTED] > > Sent: Sunday, May 20, 2007 2:10 PM > > To: users@spamassassin.apache.org > > Subject: __AOL_FROM is too American? > > > > > > > > Dears, > > > > the __AOL_FROM rule in the 20_ratware.cf file from the > > spamassassin ruleset > > looks for forged AOL From: addresses. > > > > I'm getting some messages from @aol.co.uk which score pretty > > high while > > looking legit. > > > > I see the rule is a: > > > > From:addr =~ /\@(?:aol|cs)\.com$/i > > > > which, whenever I was in right, should probably be instead > > something like: > > > > From:addr =~ /\@(?:aol|cs)\.(?:it|fr|co\.uk|com)$/i > > > > and maybe even more "internationaly": > > > > From:addr =~ /\@(?:aol|cs)\.(?:[a-z]{2}|co\.uk|com)$/i > > > > Do I have to "file" a bug request? Which list is regarding the ruleset > > borrowed with spamassassin? > Yes, filing a bug is the right way to go. Right. Probably I have to. Where? In the spamassassin's bugzilla? Where do I have to send a rule-related bug report? > Have you seen spam using these TLDs? Yes, few from aol.co.uk. Not big mass mailings, however. > It may not be meant to be just american, it may be that the only spam they > found was from aol.com? Well, actually the rule is meant to detect mails spoofing an unexistant domain in From:. So, the rule matches the only existant AOL domain that was probably running at the time it was made. Maybe AOL started country-based operations too recently for this rule to be updated. Apart co.uk, see http://www.aol.fr, in example. > If not, shame on Jmason for not thining of his buddies in .uk ;) > --Chris Nah, there is no need to shame on anybody... :) Giampaolo
