date:20060518

URI based black lists have been extremely effected in identifying spam. 
I propose another kind of black list. A list of email addresses embedded 
in the message body as replies to nigerian type spam and other spam 
where you are instructed to reply to the email address in the message body.


One thing about all spam is that the spammer wants you to do something. 
And it's what the spammer wants you to do that is the key to identifying 
spam. Most spam wants you to click on a link. So the URI black lists 
work well because it catches the sites that spammers link to.


But - a lot of spam - like nigerian spam - wants you to reply to an 
email address in the message body in order to do what the spammer wants. 
So if there were a blacklist of email addresses that spammers use as the 
place to reply then that would cut into the remaining spam 
significantly. If we can block email based on a real time list of email 
addresses within the body a whole new class of spam can be blocked with 
very high accuracy.


Who likes this idea?

RE: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread Dallas L. Engelken

> -Original Message-
> From: Marc Perkel [mailto:[EMAIL PROTECTED] 
> Sent: Thursday, May 18, 2006 9:24 AM
> To: SpamAssassin Users
> Subject: Proposal: First URI black list, how about email 
> address black lists?
> 
> URI based black lists have been extremely effected in 
> identifying spam. 
> I propose another kind of black list. A list of email 
> addresses embedded in the message body as replies to nigerian 
> type spam and other spam where you are instructed to reply to 
> the email address in the message body.
> 
> One thing about all spam is that the spammer wants you to do 
> something. 
> And it's what the spammer wants you to do that is the key to 
> identifying spam. Most spam wants you to click on a link. So 
> the URI black lists work well because it catches the sites 
> that spammers link to.
> 
> But - a lot of spam - like nigerian spam - wants you to reply 
> to an email address in the message body in order to do what 
> the spammer wants. 
> So if there were a blacklist of email addresses that spammers 
> use as the place to reply then that would cut into the 
> remaining spam significantly. If we can block email based on 
> a real time list of email addresses within the body a whole 
> new class of spam can be blocked with very high accuracy.
> 
> Who likes this idea?
> 

This has been discussed many times, even on this list.  I'd recommend
searching the archives and reading the thread on it first.  The only
problem I have with it is that it would be very manual, and address
rotation per msg would be very easy to defeat this.

Dallas

Re: Filtering windows-1252 charset

2006-05-18 Thread Philip Prindeville

Jonathan Armitage wrote:

>I see some spam with "windows-1252" or other unwanted character sets at 
>the start of the subject. I reject them via an Exim ACL, so SA doesn't 
>even have to scan them.
>  
>

Which brings up the subject...  How legitimate is email sent as
windows-1252?

I see absolutely no reason to send it, since it offers no advantage over
iso-8859-1
or utf-8, and the RFC's are pretty clear about using the "smallest"
encoding that
will fit a message, i.e. usascii => iso-8859-1 => utf-8 (in that order).

Further, if you're in the Unix world (or more broadly, not in the
Windows world),
why would you want to use vendor-specific encodings for no reason other than
they're the broken defaults Microsoft chose to use?

-Philip

Re: Delete spam or move to a folder?

2006-05-18 Thread Steven Dickenson

Couldn't find a thread like this hence this new one. Just wondering  
what strategy people are using when it comes to dealing with email  
that gets enough points to be considered as spam. Eg. being deleted  
and quarantined, or delivered and quarantined etc.


I'm using store and deliver - is that the general concept out there  
with everyone?


At work we reject any mail tagged as spam (5 points +) during the  
SMTP session.  This has the benefit of sending notification to the  
true sender rather than having my server try to delivery a NDR after  
the fact.  I haven't had a report of a false positive from any of my  
users in the last year.  Still get some false negatives (mostly  
419'er stuff), but overall my users are happy.  This set up obviously  
won't work for all organizations, but as a school we find our user  
base and email content to be rather homogenous.


At home, since I'm using fetchmail, I sort all mail tagged as spam  
into a subfolder of each users Maildir.


Steven
---
Steven Dickenson <[EMAIL PROTECTED]>
http://www.mrchuckles.net

Re: Proposal: First URI black list, how about email address black lists?


Dallas L. Engelken wrote:

 The only
problem I have with it is that it would be very manual, and address
rotation per msg would be very easy to defeat this.

Dallas

  


Even if they used a lot of email addresses in the body they would all 
have to be good addresses that got the response back to the sender. So 
there would be a lot of spam for each one. This information could be 
used by YAHOO and GOOGLE and others to shut down spammers accounts.

Re: Delete spam or move to a folder?




Steven Dickenson wrote:
Couldn't find a thread like this hence this new one. Just wondering 
what strategy people are using when it comes to dealing with email 
that gets enough points to be considered as spam. Eg. being deleted 
and quarantined, or delivered and quarantined etc.


I'm using store and deliver - is that the general concept out there 
with everyone?





I have 4 different things I do with spam depending on the spam.

If the spam scores from 5-15 points I add a header tag and pass it on. 
If the user is on my system and has a folder named spam-low I delivr it 
there.


If the spam scores 15-30 points I generate a bounce message and 
blackhole the spam. If the user has a spam-high folder they get a copy 
in there.


If the score is over 30 points I blackhold the spam, no bounce message. 
If the user has a spam-veryhigh folder they get a copy there.


If I can ID the spam at SMTP time I just DENY it and the user never sees it.

Re: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread jdow


From: "Marc Perkel" <[EMAIL PROTECTED]>

URI based black lists have been extremely effected in identifying spam. 
I propose another kind of black list. A list of email addresses embedded 
in the message body as replies to nigerian type spam and other spam 
where you are instructed to reply to the email address in the message body.


One thing about all spam is that the spammer wants you to do something. 
And it's what the spammer wants you to do that is the key to identifying 
spam. Most spam wants you to click on a link. So the URI black lists 
work well because it catches the sites that spammers link to.


But - a lot of spam - like nigerian spam - wants you to reply to an 
email address in the message body in order to do what the spammer wants. 
So if there were a blacklist of email addresses that spammers use as the 
place to reply then that would cut into the remaining spam 
significantly. If we can block email based on a real time list of email 
addresses within the body a whole new class of spam can be blocked with 
very high accuracy.


Well, Blue had something of an idea. It was simply carried too far.

As you observe every spam email contains at least one URL that is
important. It should be possible to cull the one URLs that are
important to the spammer from a list of other URLs. (A list of known
good sites would help this.) Then you use a tool that mimics browser
behavior to connect to each of these sites. If the spammer gets
paid by detected traffic on the actual advertisers web site then
this will generate a lot of spurious income for the spammer and
"detected fraud". This should pretty much cut off the spammer's
income source, except for the vertical market spammers like Leo.

Instead of freezing them out pull Google Click Fraud on them.

{^_^}

Re: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread jdow

From: "Dallas L. Engelken" <[EMAIL PROTECTED]>

-Original Message-
From: Marc Perkel [mailto:[EMAIL PROTECTED] 

URI based black lists have been extremely effected in 
identifying spam. 
I propose another kind of black list. A list of email 
addresses embedded in the message body as replies to nigerian 
type spam and other spam where you are instructed to reply to 
the email address in the message body.

One thing about all spam is that the spammer wants you to do 
something. 
And it's what the spammer wants you to do that is the key to 
identifying spam. Most spam wants you to click on a link. So 
the URI black lists work well because it catches the sites 
that spammers link to.

But - a lot of spam - like nigerian spam - wants you to reply 
to an email address in the message body in order to do what 
the spammer wants. 
So if there were a blacklist of email addresses that spammers 
use as the place to reply then that would cut into the 
remaining spam significantly. If we can block email based on 
a real time list of email addresses within the body a whole 
new class of spam can be blocked with very high accuracy.

Who likes this idea?

This has been discussed many times, even on this list.  I'd recommend
searching the archives and reading the thread on it first.  The only
problem I have with it is that it would be very manual, and address
rotation per msg would be very easy to defeat this.

Dallas
<> Directly answering his question - it is not infrequent these
days for the "answer" site to be part of a botnet, I understand. So a
blacklist would have to be bigevil.cf in size and then some.

It'd be easier to simply click fraud the sites until the vendors who
commission the spam catch on and turn off the money up front.
{^_^}

Re: Proposal: First URI black list, how about email address blacklists?

> > problem I have with it is that it would be very manual, and address
> > rotation per msg would be very easy to defeat this.

I'm in favor of this because, despite what Dallas said,

(1) Many who are really serious about quality filtering could get much use out 
of this before it even "hits the radar". It might take years for such a list to 
be used by enough ISPs and spam filter providers for this to attract attention. 
For one, this wouldn't be something for which you could take a standard mail 
software package and type in a server address (as can be done for RBL-based 
blocking)... this has to be custom programed and implemented.

(2) If the spammer resorted to use setting up multiple free e-mail accounts, at 
least that is more work for the spammer... this also increases the chance that 
they'd just prefer to be blocked by 20% of the spam filters on that one e-mail 
address and just pursue the 80% that isn't catching them with that one account 
rather than setting up multiple accounts.

(3) For those who did set up multiple accounts... couldn't this potentially 
trigger "red flags" which might provide an additional tool for the free mail 
providers to catch these guys early in the process and wouldn't they be all 
the more frustrated if/when we started quickly listing ALL of their multiple 
accounts.

Rob McEwen
PowerView Systems
[EMAIL PROTECTED]

Why Different?

2006-05-18 Thread Benjamin Adams

My client messages at a different score then on the server On my client:X-Spam-Status: 	No, hits=4.984 tagged_above=-999 required=5 tests=DIET_1, HTML_40_50, HTML_MESSAGE, UNPARSEABLE_RELAY, UPPERCASE_25_50On The server:spamassassin -t < 4391.Content analysis details:   (14.6 points, 5.0 required) pts rule name              description -- -- 0.5 UNPARSEABLE_RELAY      Informational: message has unparseable relay lines 0.5 HTML_40_50             BODY: Message is 40% to 50% HTML 3.5 HTML_MESSAGE           BODY: HTML included in message 3.5 BAYES_99               BODY: Bayesian spam probability is 99 to 100%                            [score: 1.] 1.9 RCVD_IN_NJABL_DUL      RBL: NJABL: dialup sender did non-local SMTP                            [222.52.10.129 listed in combined.njabl.org] 1.6 URIBL_SBL              Contains an URL listed in the SBL blocklist                            [URIs: aboummile.com] 3.0 URIBL_BLACK            Contains an URL listed in the URIBL blacklist                            [URIs: aboummile.com] 0.0 UPPERCASE_25_50        message body is 25-50% uppercaselocal.cfbayes_auto_learn        1bayes_file_mode         0777bayes_path              /var/mail/spamassassin/bayesbayes_auto_expire       1# Safe Reportingreport_safe             1use_dcc                 0dcc_timeout             10use_razor2              0use_pyzor               1rewrite_header Subject SPAM# Rewrite the Subjectskip_rbl_checks         0# Use Bayesian Filteringuse_bayes               1use_bayes_rules         1bayes_learn_during_report 1# OK localsok_locales enI give it a config location with spamdI'm trying to figure out why the server would display something different then the messages coming in.Any ideas? -Ben

Re: Proposal: First URI black list, how about email address black lists?

jdow said:
>It'd be easier to simply click fraud the sites until the vendors who
>commission the spam catch on and turn off the money up front.

I think you've misunderstood Marc's proposal. He is talking about identity 
theft schemes via Nigeria "419" scams where there is only an e-mail address in 
the body of the message.

Rob McEwen
PowerView Systems
[EMAIL PROTECTED]
(478) 475-9032

Re: Proposal: First URI black list, how about email address black lists?




jdow wrote:

From: "Dallas L. Engelken" <[EMAIL PROTECTED]>

Dallas
<> Directly answering his question - it is not infrequent these
days for the "answer" site to be part of a botnet, I understand. So a
blacklist would have to be bigevil.cf in size and then some.

It'd be easier to simply click fraud the sites until the vendors who
commission the spam catch on and turn off the money up front.
{^_^}



OK - you guys are missing part of the idea. The idea is that there is 
some central database that is maintained for lookups sort of like razor 
and pyzor or spamcop, or the URI lists, etc. and you make a call to the 
central database to see if the email address in question is listed in 
it. If it is, then you have a spammer.

Re: Proposal: First URI black list, how about email address blacklists?

Rob McEwen (PowerView Systems) wrote:

problem I have with it is that it would be very manual, and address
rotation per msg would be very easy to defeat this.

I'm in favor of this because, despite what Dallas said,

(1) Many who are really serious about quality filtering could get much use out of this before it even "hits the radar". It might take years for such a list to be used by enough ISPs and spam filter providers for this to attract attention. For one, this wouldn't be something for which you could take a standard mail software package and type in a server address (as can be done for RBL-based blocking)... this has to be custom programed and implemented.

(2) If the spammer resorted to use setting up multiple free e-mail accounts, at least that is more work for the spammer... this also increases the chance that they'd just prefer to be blocked by 20% of the spam filters on that one e-mail address and just pursue the 80% that isn't catching them with that one account rather than setting up multiple accounts.

(3) For those who did set up multiple accounts... couldn't this potentially trigger "red flags" which might provide an additional tool for the free mail providers to catch these guys early in the process and wouldn't they be all the more frustrated if/when we started quickly listing ALL of their multiple accounts.

Rob McEwen
PowerView Systems
[EMAIL PROTECTED]

I'm not sure it would take years. If someone created a centralized
database and SA had a rule to talk to it then it would be just part of
SA and ISPs would automatically addopt it as part of the standard SA
package.

Re: Proposal: First URI black list, how about email address black lists?







Rob McEwen (PowerView Systems) wrote:

  jdow said:
  
  
It'd be easier to simply click fraud the sites until the vendors who
commission the spam catch on and turn off the money up front.

  
  
I think you've misunderstood Marc's proposal. He is talking about identity theft schemes via Nigeria "419" scams where there is only an e-mail address in the body of the message.


  

Yes Rob, that's exactly it. Just like the URIBL catches spam that links
to spam sites the email address would catch email addresses used as th
reply address to 419 scams. That would leave onle the stock market
scams as yet to be solved. :)

RE: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread Dallas L. Engelken

> -Original Message-
> From: Dallas L. Engelken [mailto:[EMAIL PROTECTED] 
> Sent: Thursday, May 18, 2006 9:34 AM
> To: SpamAssassin Users
> Subject: RE: Proposal: First URI black list, how about email 
> address black lists?
> 
> > -Original Message-
> > From: Marc Perkel [mailto:[EMAIL PROTECTED]
> > Sent: Thursday, May 18, 2006 9:24 AM
> > To: SpamAssassin Users
> > Subject: Proposal: First URI black list, how about email 
> address black 
> > lists?
> > 
> > URI based black lists have been extremely effected in identifying 
> > spam.
> > I propose another kind of black list. A list of email addresses 
> > embedded in the message body as replies to nigerian type spam and 
> > other spam where you are instructed to reply to the email 
> address in 
> > the message body.
> > 
> > One thing about all spam is that the spammer wants you to do 
> > something.
> > And it's what the spammer wants you to do that is the key to 
> > identifying spam. Most spam wants you to click on a link. 
> So the URI 
> > black lists work well because it catches the sites that 
> spammers link 
> > to.
> > 
> > But - a lot of spam - like nigerian spam - wants you to reply to an 
> > email address in the message body in order to do what the spammer 
> > wants.
> > So if there were a blacklist of email addresses that 
> spammers use as 
> > the place to reply then that would cut into the remaining spam 
> > significantly. If we can block email based on a real time list of 
> > email addresses within the body a whole new class of spam can be 
> > blocked with very high accuracy.
> > 
> > Who likes this idea?
> > 
> 
> This has been discussed many times, even on this list.  I'd 
> recommend searching the archives and reading the thread on it 
> first.  The only problem I have with it is that it would be 
> very manual, and address rotation per msg would be very easy 
> to defeat this.
> 

Well, the only thread on sa-users I found about this was from Dec 2005.
http://www.nabble.com/A-thought-about-phone-numbers-and-URIBLs-t716464.h
tml

We had a thread on uribl staff list about this last July which we
cross-posted to sare where loren brought up some good points.   After a
good discussion on it, it dropped off the radar as something that would
take to much time and have very little impact.

If anyone plans to move forward with this, I'd be willing to share our
threads on it.

Dallas

Re: Proposal: First URI black list, how about email address blacklists?

2006-05-18 Thread qqqq

I agree this is a great idea.  If Dallas and Chris don't desire to host the 
infrastructure for
something like this, I can help out in terms of a Master or slave server.

RE: Filtering windows-1252 charset

2006-05-18 Thread Bret Miller

> Which brings up the subject...  How legitimate is email sent as
> windows-1252?
>
> I see absolutely no reason to send it, since it offers no
> advantage over
> iso-8859-1
> or utf-8, and the RFC's are pretty clear about using the "smallest"
> encoding that
> will fit a message, i.e. usascii => iso-8859-1 => utf-8 (in
> that order).
>
> Further, if you're in the Unix world (or more broadly, not in the
> Windows world),
> why would you want to use vendor-specific encodings for no
> reason other than
> they're the broken defaults Microsoft chose to use?

I don't sending a specific character set is a choice most users make. I
have 84 messages in my inbox with windows-1252 character set. A lot of
those are personal messages sent by friends that are clueless as far as
their computers are concerned. So, unless you can get Microsoft to
configure their clients so they don't send that character set by
default, or unless you don't have any friends with Windows, you might
research it a bit more before you block.

Bret

Re: Filtering windows-1252 charset

2006-05-18 Thread Craig McLean

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Philip Prindeville wrote:
> Jonathan Armitage wrote:
> 
>> I see some spam with "windows-1252" or other unwanted character sets at 
>> the start of the subject. I reject them via an Exim ACL, so SA doesn't 
>> even have to scan them.
>>  
>>
> 
> Which brings up the subject...  How legitimate is email sent as
> windows-1252?

I have a bunch of stuff from paypal and ebay, and much more, which
include this charset.
I'm not attempting to answer the philosophical question, just the
statistical one.

C.

- --
Craig McLeanhttp://fukka.co.uk
[EMAIL PROTECTED]   Where the fun never starts
Powered by FreeBSD, and GIN!
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEbJwCMDDagS2VwJ4RAgcdAJ0bIf+EPRmsGEFhqeamY6W5dWBwVgCeLbPf
dALIAlLZans4C6EM6R17nyU=
=IUJJ
-END PGP SIGNATURE-

Re: Why Different?

2006-05-18 Thread Ninja Dude


Benjamin Adams wrote:

 On my client:
X-Spam-Status:  No, hits=4.984 tagged_above=-999 required=5 tests=DIET_1,

> HTML_40_50, HTML_MESSAGE, UNPARSEABLE_RELAY, UPPERCASE_25_50

...


On The server:

...

3.5 BAYES_99   BODY: Bayesian spam probability is 99 to 100%
[score: 1.]
1.9 RCVD_IN_NJABL_DUL  RBL: NJABL: dialup sender did non-local SMTP
[222.52.10.129 listed in combined.njabl.org]
1.6 URIBL_SBL  Contains an URL listed in the SBL blocklist
[URIs: aboummile.com]
3.0 URIBL_BLACKContains an URL listed in the URIBL blacklist
[URIs: aboummile.com]


As a guess, I'd say that your client (do you mean your actual mail 
client, or do you mean something that adds this header as the message 
arrives?) isn't running Bayes or network tests, but your server is.


If you're running SA through amavisd-new, check the config there and 
make sure it's not set to run only local tests.  That should bring in 
3.5 points from RCVD_IN_NJABL_DUL and URIBL_SBL.


Also, see if Amavisd-new has problems with rules added from sa-update. 
I'm not familiar with Amavisd, but MIMEDefang had to add support for 
those rules.  IIRC, URIBL_BLACK isn't in the base distribution yet, but 
is in the sa-update set.

RE: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread Chris Santerre

Title: RE: Proposal: First URI black list, how about email address black lists?







> -Original Message-
> From: Marc Perkel [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, May 18, 2006 11:09 AM
> To: jdow
> Cc: users@spamassassin.apache.org
> Subject: Re: Proposal: First URI black list, how about email address
> black lists?
> 
> 
> 
> 
> jdow wrote:
> > From: "Dallas L. Engelken" <[EMAIL PROTECTED]>
> >
> > Dallas
> > <> Directly answering his question - it is not 
> infrequent these
> > days for the "answer" site to be part of a botnet, I 
> understand. So a
> > blacklist would have to be bigevil.cf in size and then some.
> >
> > It'd be easier to simply click fraud the sites until the vendors who
> > commission the spam catch on and turn off the money up front.
> > {^_^}
> >
> 
> OK - you guys are missing part of the idea. The idea is that there is 
> some central database that is maintained for lookups sort of 
> like razor 
> and pyzor or spamcop, or the URI lists, etc. and you make a 
> call to the 
> central database to see if the email address in question is listed in 
> it. If it is, then you have a spammer.


We have a hard enough time with tons of new domains in URIBL. Those cost money and IMHO a bit more steps to go thru to setup then an email address. I can't imagine trying to keep up with it. They would expire within hours. 

Its a good thought, and ike Dallas has said, its been talked about. But sooo much work. 


Also LOL @ jdow. "bigevil" is now an adjective ;) 


--Chris

LOCAL_RCVD

2006-05-18 Thread Shelley Waltz

Spamassassin 2.63-1/amavisd-new-20030616-p8

I am trying to configure spamassassin such that any email originating
from my domain is not spam tagged.  I have tried in local.cf

both these syntaxes.

header LOCAL_RCVD Received =~ /.*\(\S+\.myhost\.mydom\.edu\s+\[.*\]\)/
header LOCAL_RCVD Received =~ /\S+\.myhost\.mydom\.edu\s+\(.*\[.*\]\)/


In each case only one rule will work for one particular received from
header.  I have these two styles(one from mozilla, and one from webmail)

Received: from [192.168.1.10] (myhost.mydom.edu [192.168.1.10])

Received: from webmail.mydom.edu (localhost.localdomain [127.0.0.1])

Is there a rule which will work for both, or is there a simpler way to
achieve this result, ie, to not filter locallly originating mail?




Shelley Waltz

Re: LOCAL_RCVD

2006-05-18 Thread Justin Mason


Shelley Waltz writes:
> Spamassassin 2.63-1/amavisd-new-20030616-p8
> 
> I am trying to configure spamassassin such that any email originating
> from my domain is not spam tagged.  I have tried in local.cf
> 
> both these syntaxes.
> 
> header LOCAL_RCVD Received =~ /.*\(\S+\.myhost\.mydom\.edu\s+\[.*\]\)/
> header LOCAL_RCVD Received =~ /\S+\.myhost\.mydom\.edu\s+\(.*\[.*\]\)/
> 
> 
> In each case only one rule will work for one particular received from
> header.  I have these two styles(one from mozilla, and one from webmail)
> 
> Received: from [192.168.1.10] (myhost.mydom.edu [192.168.1.10])
> 
> Received: from webmail.mydom.edu (localhost.localdomain [127.0.0.1])
> 
> Is there a rule which will work for both, or is there a simpler way to
> achieve this result, ie, to not filter locallly originating mail?

use trusted_networks; this is what ALL_TRUSTED is for.

--j.

SA 3.1.0, postfix and amavis-new questions

2006-05-18 Thread Gene Hendrickson

I have SA 3.1.0 with postfix and amavis-new.  When I look in the logs i see
both SA and amavis scanning email for spam.  They get wildly different
scores.  Are they both supposed to be scanning?  Also, is there any way I
can have SA scores written to the header instead of amavis?  Thanks.

Gene

Re: Proposal: First URI black list, how about email address black lists?

Title: RE: Proposal: First URI black list, how about email address
black lists?






Chris Santerre wrote:

  
  
  
  
  We have a hard enough time with tons of new domains
in URIBL. Those cost money and IMHO a bit more steps to go thru to
setup then an email address. I can't imagine trying to keep up with it.
They would expire within hours. 
  

Remember we're not talking about the From address but the address
within the message that they want you to reply to. That address isn't
going to expire very fast because that's how the spammer gets the
money. I would say however that these email addresses could be expired
over a few weeks perhaps.

I also think that these lists could be used for a check of outgoing
email to see of people (suckers) are responding and to perhaps
intercept the email and warn the sender that they are replying to a
known scammer. Just a thought.

Re: A lot of these going around

David Baron wrote:
> May 18 11:50:22 d_baron spamc[5797]: connect(AF_INET) to spamd at 127.0.0.1 
> failed, retrying (#1 of 3): Connection refused
> 
> Seems harmless though annoying.
> Fix?

Is spamd running?

Re: Proposal: First URI black list, how about email address blacklists?

It could actually be a benefit if/when the e-mail address account was 
terminated because this could keep the overall size of the list smaller. I 
wonder if there is some automated way to check this getting in trouble for 
spamming or abusing the free hosting service?

Rob McEwen
PowerView Systems
[EMAIL PROTECTED]

Re: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread qqqq

RE: Proposal: First URI black list, how about email address black 
lists?>Remember we're not talking
about the From address but the address within the message that they want you to 
>reply to. That
address isn't going to expire very fast because that's how the spammer gets the 
money. I would say
>however that these email addresses could be expired over a few weeks perhaps.

>I also think that these lists could be used for a check of outgoing email to 
>see of people
(suckers) are responding >and to perhaps intercept the email and warn the 
sender that they are
replying to a known scammer. Just a thought.

Here's a good example:

Hello Good Fellows,
I know it's hard to find a true real and honest money making on the net
because I had alsoexperienced and onced tired of always started some
new opportunities until i met this one of its kind online business that catches
my interest and attention.

Coz' I can even say "Your Search Is Over !" So stop searching and give
this a try.
Just Email Me at
[EMAIL PROTECTED]
Put "" Register me for a free Membership"" in the subject,
Be sure to include:
1. First name:
2. Last name:
3. Email Address:
4. Country:
That's All there is to it.
We Will confirm your position and send you a special report as soon as
possible, and also Your free membership ID#.
My best regards,

Pablito Ed Tabar
[EMAIL PROTECTED]
Note: p.s. This is one time email. If you wish to remove. Kindly email to :
[EMAIL PROTECTED]
with the subject of your email "Remove Me"

Re: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread qqqq

RE: Proposal: First URI black list, how about email address black 
lists?>Remember we're not talking
about the From address but the address within the message that they want you to 
>reply to. That
address isn't going to expire very fast because that's how the spammer gets the 
money. I would say
>however that these email addresses could be expired over a few weeks perhaps.

>I also think that these lists could be used for a check of outgoing email to 
>see of people
(suckers) are responding >and to perhaps intercept the email and warn the 
sender that they are
replying to a known scammer. Just a thought.

Here's a good example:

Hello Good Fellows,
I know it's hard to find a true real and honest money making on the net
because I had alsoexperienced and onced tired of always started some
new opportunities until i met this one of its kind online business that catches
my interest and attention.

Coz' I can even say "Your Search Is Over !" So stop searching and give
this a try.
Just Email Me at
[EMAIL PROTECTED]
Put "" Register me for a free Membership"" in the subject,
Be sure to include:
1. First name:
2. Last name:
3. Email Address:
4. Country:
That's All there is to it.
We Will confirm your position and send you a special report as soon as
possible, and also Your free membership ID#.
My best regards,

Pablito Ed Tabar
[EMAIL PROTECTED]
Note: p.s. This is one time email. If you wish to remove. Kindly email to :
[EMAIL PROTECTED]
with the subject of your email "Remove Me"

Re: Proposal: First URI black list, how about email address blacklists?




Rob McEwen (PowerView Systems) wrote:

It could actually be a benefit if/when the e-mail address account was 
terminated because this could keep the overall size of the list smaller. I 
wonder if there is some automated way to check this getting in trouble for 
spamming or abusing the free hosting service?

Rob McEwen
PowerView Systems
[EMAIL PROTECTED]

  


I'm just going to throw this out there having not thought this through 
but if the spammer moves on to a different account then compaints 
against that email address will cease. I say that if and email address 
hasn't receives a complaint in a few days then you can purge it. You 
don't want to purge it the moment the email account is closed because 
there may still be spam bots out there sending spam with that email 
address in it.


I also envision some sort of reporting to the ISP so they can quickly 
shut down the accounts.

Re: Proposal: First URI black list, how about email address blacklists?

Marc Perkel wrote:

> 
> I'm just going to throw this out there having not thought this through
> but if the spammer moves on to a different account then compaints
> against that email address will cease. I say that if and email address
> hasn't receives a complaint in a few days then you can purge it. You
> don't want to purge it the moment the email account is closed because
> there may still be spam bots out there sending spam with that email
> address in it.
> 
> I also envision some sort of reporting to the ISP so they can quickly
> shut down the accounts.

You mean like spamcop?

Re: Proposal: First URI black list, how about email address blacklists?







Matt Kettler wrote:

  Marc Perkel wrote:

  
  
I'm just going to throw this out there having not thought this through
but if the spammer moves on to a different account then compaints
against that email address will cease. I say that if and email address
hasn't receives a complaint in a few days then you can purge it. You
don't want to purge it the moment the email account is closed because
there may still be spam bots out there sending spam with that email
address in it.

I also envision some sort of reporting to the ISP so they can quickly
shut down the accounts.

  
  
You mean like spamcop?
  

Yes - like spamcop - but instead of spamcop just having a URI list they have a list of email addresses used as the reply address of 419 scammers.

Re: Proposal: First URI black list, how about email address blacklists?

Marc Perkel wrote:
> 
> 
> Matt Kettler wrote:
>> Marc Perkel wrote:
>>
>>   
>>> I'm just going to throw this out there having not thought this through
>>> but if the spammer moves on to a different account then compaints
>>> against that email address will cease. I say that if and email address
>>> hasn't receives a complaint in a few days then you can purge it. You
>>> don't want to purge it the moment the email account is closed because
>>> there may still be spam bots out there sending spam with that email
>>> address in it.
>>>
>>> I also envision some sort of reporting to the ISP so they can quickly
>>> shut down the accounts.
>>> 
>>
>> You mean like spamcop?
>>   
> Yes - like spamcop - but instead of spamcop just having a URI list they have 
> a list of email addresses used as the reply address of 419 scammers.


Spamcop itself is not just URIs, that the SURBL list based on spamcop data..

Spamcop, the whole system, does a lot of reporting. Generation of the URI list
is incidental to their generating reports that get sent to the ISPs of webhosts
that are spamvertized.

Re: A lot of these going around

2006-05-18 Thread David Baron

On Thursday 18 May 2006 20:40, Matt Kettler wrote:
> David Baron wrote:
> > May 18 11:50:22 d_baron spamc[5797]: connect(AF_INET) to spamd at
> > 127.0.0.1 failed, retrying (#1 of 3): Connection refused
> >
> > Seems harmless though annoying.
> > Fix?
>
> Is spamd running?

Of course.

RE: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread Chris Santerre

Title: RE: Proposal: First URI black list, how about email address blacklists?







> -Original Message-
> From: Rob McEwen (PowerView Systems) [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, May 18, 2006 1:48 PM
> To: users@spamassassin.apache.org
> Subject: Re: Proposal: First URI black list, how about email address
> blacklists?
> 
> 
> It could actually be a benefit if/when the e-mail address 
> account was terminated because this could keep the overall 
> size of the list smaller. I wonder if there is some automated 
> way to check this getting in trouble for spamming or abusing 
> the free hosting service?


And when the spammers use a joe jobbed email address, what will you do? How will you know if it really is a drop box, or someones real email address being Joe Jobbed to mess up your list? Believe me, the spammer will feed false info to give your list a bad name. 

A URL can be checked. A private email account can't be. And if its one thing spammers have a lot of, its legit email addresses to joe job with. 

I'm honestly not trying to be a little black rain cloud. I just hope you look at all the possibilities. 


--Chris

Re: A lot of these going around

David Baron wrote:
> On Thursday 18 May 2006 20:40, Matt Kettler wrote:
>> David Baron wrote:
>>> May 18 11:50:22 d_baron spamc[5797]: connect(AF_INET) to spamd at
>>> 127.0.0.1 failed, retrying (#1 of 3): Connection refused
>>>
>>> Seems harmless though annoying.
>>> Fix?
>> Is spamd running?
> 
> Of course.
> 

Is spamd configured to allow connections from 127.0.0.1?

(ie: what are you passing after the -A parameter to spamd?)

RE: Proposal: First URI black list, how about email address blacklists?

> And when the spammers use a joe jobbed email address, what will you do? How
> will you know if it really is a drop box, or someones real email address
> being Joe Jobbed to mess up your list? Believe me, the spammer will feed
> false info to give your list a bad name. 

Chris, that is a really good point.

I have three answers:

(1) I'm hoping that being below the radar might prevent some of what you are 
talking about... at least a while. And I don't think that the nigeria spammers 
are the type of spammers who'd frequent this list, for example, as much much as 
other spammers do, but I could be wrong about that.

(2) Messages caught by an e-mal based dnsbl probably shouldn't, by themselves, 
score high enough to cause a message to be outright blocked. In fact, I often 
catch these scam messages in my rules based filtering... only to find that, 
sometimes, they scored just below the threshold of being placed in the spam 
folder. A dnsbl service like this could put those particular messages "over the 
top" without harming a mislisted address, if used as I've described.

(3) Chances are, a single randomly picked e-mail address that was joe-jobbed 
would have just about 0% chance of showing up in a particular server that 
happened to use this service. Especially give the incredibly low percentage of 
servers which might potentially use this anytime in the next months or years.

Rob McEwen
PowerView Systems
[EMAIL PROTECTED]

Re: Filtering windows-1252 charset

2006-05-18 Thread Kai Schaetzl

Philip Prindeville wrote on Thu, 18 May 2006 08:47:48 -0600:

> How legitimate is email sent as 
> windows-1252?

Very, because broken Windows clients use it.

Kai

-- 
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

Re: Minimizing spamd's memory footprint

2006-05-18 Thread Michael Monnerie

On Donnerstag, 18. Mai 2006 01:31 Kai Schaetzl wrote:
> > That list would most definetly ... get your cat pregnant!
> Hm, quite powerful medicine then, hm? ;-)

Probably he shouldn't filter those DRUGS spam then and buy some of 
these. I'm sure some sell anti baby pills for cats. *g*

mfg zmi
-- 
// Michael Monnerie, Ing.BSc-  http://it-management.at
// Tel: 0660/4156531  .network.your.ideas.
// PGP Key:   "lynx -source http://zmi.at/zmi3.asc | gpg --import"
// Fingerprint: 44A3 C1EC B71E C71A B4C2  9AA6 C818 847C 55CB A4EE
// Keyserver: www.keyserver.net Key-ID: 0x55CBA4EE


pgph5hvPypF9s.pgp
Description: PGP signature

Re: Delete spam or move to a folder?

2006-05-18 Thread Craig McLean

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Will Nordmeyer wrote:

> Craig,
>
> How do you have procmail set up to deliver to the spam vs. likely spam
> folders?

Use the "X-Spam-Level" marker. Anything with < 10 stars and a
"X-Spam-Status" of "Yes" gets put in a 'likely-spam' folder. Anything
else goes to 'spam'.

C.
- --
Craig McLeanhttp://fukka.co.uk
[EMAIL PROTECTED]   Where the fun never starts
Powered by FreeBSD, and GIN!
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEbOizMDDagS2VwJ4RAhmQAJ9jzjQCSdnH+HgZul/5KptDsSLhBwCg9vPc
0Ga2XQi7nrNQL1lJaeQmtUw=
=ails
-END PGP SIGNATURE-

Re: Proposal: First URI black list, how about email address black lists?

2006-05-18 Thread Craig McLean

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Dallas L. Engelken wrote:
> 
> Well, the only thread on sa-users I found about this was from Dec 2005.
> http://www.nabble.com/A-thought-about-phone-numbers-and-URIBLs-t716464.h
> tml
> 
> We had a thread on uribl staff list about this last July which we
> cross-posted to sare where loren brought up some good points.   After a
> good discussion on it, it dropped off the radar as something that would
> take to much time and have very little impact.
> 
> If anyone plans to move forward with this, I'd be willing to share our
> threads on it.
> 
> Dallas

Actually, after some off-list chat with Rob Skedgell I recently finished
a first attempt at a plugin for a dnsbl for phone numbers[1], having put
together a monstrous, by-country static ruleset based on international
dialing codes[2]. It's met with reasonable success here against 419 and
associated check-fraud spam using harvested data[3], but will need some
serious thought, testing, tweaking and infrastructure before it can be
used in production...

I'd be intrigued to read any other comments and discussion that have
happened...

Thanks,
C.

[1] http://fukka.co.uk/sa-rules/local/PhoneBL.pm
[2] http://fukka.co.uk/sa-rules/local/phone.cf
[3] http://fukka.co.uk/sa-rules/local/evilnumbers.db
- --
Craig McLeanhttp://fukka.co.uk
[EMAIL PROTECTED]   Where the fun never starts
Powered by FreeBSD, and GIN!
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEbO81MDDagS2VwJ4RAnrcAJ9VkTH6Py8SYqeqFuPKdhqiFJkZHACgrm8M
qUy8K2/4EIZUZh2bQuoQACY=
=OKu+
-END PGP SIGNATURE-

Re: Proposal: First URI black list, how about email address black lists?

I believe that using email addresses that are embedded in 419 type spams 
as a spam fingerprint will be as effective against 419 typre spam as 
URIBL is for identifying spam that has links in it.


All spam has one thing in common. Spam wants you to DO something. And 
what it wants you to do is either click on something or send an email 
somewhere. If we focus on identifying spam on what it wants us to do 
then we have the fingerprint.

URL-encoded hostnames in email links

2006-05-18 Thread John D. Hardin


Re:  http://isc.sans.org/diary.php?storyid=1342

(1) Are there any rules currently in SA or SARE that will trigger on
encoded characters in the hostname part of a URL?

(2) Does the URL extractor for SURBL checks properly deal with
URL-encoded hostnames?

--
 John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/
 [EMAIL PROTECTED]FALaholic #11174pgpk -a [EMAIL PROTECTED]
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  The problem is when people look at Yahoo, slashdot, or groklaw and
  jump from obvious and correct observations like "Oh my God, this
  place is teeming with utter morons" to incorrect conclusions like
  "there's nothing of value here".-- Al Petrofsky, in Y! SCOX
---

list of rules

2006-05-18 Thread Paul Matthews

Hi there,

I've just installed spam assassin and it's working okay, but some spam is
still getting in, I only have like 3 rules at the moment that I added in,
is there a list of pretty safe rules out there that I could just copy into
my local.cf SA file?

Re: list of rules

Paul Matthews wrote:
> Hi there,
> 
> I've just installed spam assassin and it's working okay, but some spam is
> still getting in, I only have like 3 rules at the moment that I added in,

Care to specify which ones?

> is there a list of pretty safe rules out there that I could just copy into
> my local.cf SA file?

Well, I usually don't copy rules into my local.cf, I copy whole rulefiles at a
time. (SA will parse all the .cf files in /etc/mail/spamassassin, not just
local.cf. So all you need to do is download the .cf files).

In general, I would suggest not adding on ANY rules to start with. Only use the
default set for a little bit, to get a feel for what works for you,

Also, make sure you've got Net::DNS installed. The SA default ruleset has a LOT
of very powerful rules that depend on DNS.

As for add-ons' I get good results from the following rulesets from SARE. After
running a bit with the default set, these would be good add-ons to start with.

70_sare_adult.cf
70_sare_evilnum0.cf
70_sare_genlsubj0.cf
70_sare_html0.cf
70_sare_obfu0.cf
70_sare_random.cf
70_sare_specific.cf
70_sare_stocks.cf
70_sare_uri0.cf
99_FVGT_Tripwire.cf
99_sare_fraud_post25x.cf

I strongly suggest not using sa-blacklist.cf or sa-blacklist-uri.cf unless you
have a LOT (more than 4GB) of ram. Both of these are SEVERE memory hogs.

I also make use of a modified version of the rules for uribl.com's add-on uribl:

urirhssub   URIBL_BLACK  multi.uribl.com.A   2
bodyURIBL_BLACK  eval:check_uridnsbl('URIBL_BLACK')
describeURIBL_BLACK  Contains an URL listed in the URIBL blacklist
tflags  URIBL_BLACK  net
score   URIBL_BLACK  1.5

# note: grey is an informational rule. It OFTEN matches nonspam.
# in fact, it tends to match more nonspam than spam. (S/O's are
# in the 0.55-0.30 range)

urirhssub   URIBL_GREY  multi.uribl.com.A   4
bodyURIBL_GREY  eval:check_uridnsbl('URIBL_GREY')
describeURIBL_GREY  Contains an URL listed in the URIBL greylist
tflags  URIBL_GREY  net
score   URIBL_GREY  0.001

> 
>

Re: URL-encoded hostnames in email links

John D. Hardin wrote:
> Re:  http://isc.sans.org/diary.php?storyid=1342
> 
> (1) Are there any rules currently in SA or SARE that will trigger on
> encoded characters in the hostname part of a URL?
> 
> (2) Does the URL extractor for SURBL checks properly deal with
> URL-encoded hostnames?

Yes, SA in general deals with most forms of URI encoding.

The surbl checks are not confused by the use of ".%63%6f%6d" instead of ".com".
The general SA architecture decodes these long before the surbl rules see it.

I also don't understand why this is a new thing to the ISC handler's diary.
Spammers have been using that trick for a LOONG time. It's more common in
phishing than spam, but it's still common in both.

Re: REMOVE and Don't Send These Emails

Please cease and desist sending me automated backscatter in response to postings
regarding spamassassin-talk list.


Either unsubscribe yourself from the list, or stop generating backscatter.

Further backscatter will be reported to spamcop as such.




[EMAIL PROTECTED] wrote:
> You are emailing from or for a product we aren't interested in
> from any domain ending in hex coded .C0M
>  
> You are sending unsolicited and unwanted SPAM.
> 
> Cease and desist and remove all email addresses with the words
> ourfam or ourldsfamily from your databases.
> 
> Stop sending emails without a workable option to unsubscribe
> before we're forced to take legal action in accordance with
> US Code Title 47, Sec.227(b)(1)(C), Sec.227(a)(2)(B).
> 
> In accordance with the above laws, violation of our privacy with advertising
> or SPAM may result in a MINIMUM of $500 damages/incident, $1500 for repeats.
> 
>  
>

[OT] Re: REMOVE and Don't Send These Emails

2006-05-18 Thread Rick Macdougall


Matt Kettler wrote:

Please cease and desist sending me automated backscatter in response to postings
regarding spamassassin-talk list.


Either unsubscribe yourself from the list, or stop generating backscatter.

Further backscatter will be reported to spamcop as such.




[EMAIL PROTECTED] wrote:

You are emailing from or for a product we aren't interested in
from any domain ending in hex coded .C0M
 
You are sending unsolicited and unwanted SPAM.


Cease and desist and remove all email addresses with the words
ourfam or ourldsfamily from your databases.

Stop sending emails without a workable option to unsubscribe
before we're forced to take legal action in accordance with
US Code Title 47, Sec.227(b)(1)(C), Sec.227(a)(2)(B).

In accordance with the above laws, violation of our privacy with advertising
or SPAM may result in a MINIMUM of $500 damages/incident, $1500 for repeats.

 





Our LDS Family ?

Strange.

Re: [OT] Re: REMOVE and Don't Send These Emails

2006-05-18 Thread Evan Platt

On Thu, May 18, 2006 4:25 pm, Rick Macdougall wrote:
> Our LDS Family ?
>
> Strange.

LDS = Latter Day Saints (Mormons).

Re: [OT] Re: REMOVE and Don't Send These Emails

2006-05-18 Thread Rick Macdougall


Evan Platt wrote:

On Thu, May 18, 2006 4:25 pm, Rick Macdougall wrote:

Our LDS Family ?

Strange.


LDS = Latter Day Saints (Mormons).



Ja, I know what is is, I just found the url strange.

*Shrug* but what do I know.

Re: Re: [OT] Re: REMOVE and Don't Send These Emails

2006-05-18 Thread Nigel Frankcom

Probably need a couple of extra wives to explain it to you ;-D

On Thu, 18 May 2006 19:30:56 -0400, Rick Macdougall
<[EMAIL PROTECTED]> wrote:

>Evan Platt wrote:
>> On Thu, May 18, 2006 4:25 pm, Rick Macdougall wrote:
>>> Our LDS Family ?
>>>
>>> Strange.
>> 
>> LDS = Latter Day Saints (Mormons).
>> 
>
>Ja, I know what is is, I just found the url strange.
>
>*Shrug* but what do I know.
>

Re: list of rules

2006-05-18 Thread Theo Van Dinter

On Thu, May 18, 2006 at 06:52:23PM -0400, Matt Kettler wrote:
> > is there a list of pretty safe rules out there that I could just copy into
> > my local.cf SA file?

Are you using sa-update?

> I also make use of a modified version of the rules for uribl.com's add-on 
> uribl:

Is there a reason to not just use the uribl.com rules that are already
included with the stock SA?

-- 
Randomly Generated Tagline:
"They were printing out the damn bible ... Jesus Christ!" - Matt


pgp9BRR3sCm5I.pgp
Description: PGP signature

Re: list of rules

2006-05-18 Thread Paul Matthews

> Are you using sa-update?

i'm not sure, how do i know if i am, but i did a locate sa-update and i
came up with nothing so i have to guess that i'm not.

Although, i've found the website

http://www.sa-blacklist.stearns.org/sa-blacklist/

and i've add the following information into a script and set it to run as
a cron job once a week.

wget http://www.sa-blacklist.stearns.org/sa-blacklist/sa-blacklist.current.cf
wget
http://www.sa-blacklist.stearns.org/sa-blacklist/sa-blacklist.current.uri.cf
wget http://www.sa-blacklist.stearns.org/sa-blacklist/random.current.cf

Has anyone out there used this website? is it any good? does it work?

Re: list of rules

Paul Matthews wrote:
>> Are you using sa-update?
>> 
>
> i'm not sure, how do i know if i am, but i did a locate sa-update and i
> came up with nothing so i have to guess that i'm not.
>   

What version of SA are you using? If older than 3.1.1, consider
upgrading to the current version before adding on extra rulesets.
> Although, i've found the website
>
> http://www.sa-blacklist.stearns.org/sa-blacklist/
>
> and i've add the following information into a script and set it to run as
> a cron job once a week.
>
> wget http://www.sa-blacklist.stearns.org/sa-blacklist/sa-blacklist.current.cf
> wget
> http://www.sa-blacklist.stearns.org/sa-blacklist/sa-blacklist.current.uri.cf
> wget http://www.sa-blacklist.stearns.org/sa-blacklist/random.current.cf
>
> Has anyone out there used this website? is it any good? does it work?
>   

DO NOT use the sa-blackset rules. Either of them.

1) sa-blacklist is based on email addresses. This is not a very
effective tactic for fighting spam.

2) sa-blacklist is a nearly 2meg file, which will increase your spamd
size by about 100 megs per-instance. This massive memory increase will
grind most boxes to a halt.

3) sa-blacklist-uri is superseded by the URIBL test  URIBL_WS_SURBL.
This test is more accurate (it's a live query to DNS, thus rapidly
updated) and uses much less memory. However, it does require use of DNS.

Re: list of rules

2006-05-18 Thread Paul Matthews

> What version of SA are you using? If older than 3.1.1, consider
> upgrading to the current version before adding on extra rulesets.

i'm running RHEL4 with spamassassin-3.0.5-3.el4

I don't want to upgrade because I manage all my packages with redhat's
up2date program and a new version of SA hasn't been release with RHEL4
yet.

> 1) sa-blacklist is based on email addresses. This is not a very
> effective tactic for fighting spam.

Fair enough, removes file

> 2) sa-blacklist is a nearly 2meg file, which will increase your spamd
> size by about 100 megs per-instance. This massive memory increase will
> grind most boxes to a halt.

it's accually a 13 mg file and your right, i did notice a big drop in
preformance

> 3) sa-blacklist-uri is superseded by the URIBL test  URIBL_WS_SURBL.
> This test is more accurate (it's a live query to DNS, thus rapidly
> updated) and uses much less memory. However, it does require use of DNS.

I've removed all the files that I got from that website, but i'm still
looked for a self updating soluation for SA.

Any idea's?


-- 
Paul Matthews
Junior Network Technician | The Cathedral School
Ph  (07) 47222 194 |  Fax (07) 47222 111
PO Box 944 Aitkenvale Q 4814
E:  [EMAIL PROTECTED]
W: www.cathedral.qld.edu.au

Anglican coeducation | Day and Boarding | Early Childhood to Year 12
Educating for life-long success



***

IMPORTANT NOTICE REGARDING CONFIDENTIALITY

This electronic email message is intended only for the addressee and may
contain confidential information. If you are not the addressee, you are
notified that any transmission, distribution or photocopying of this email
is strictly prohibited. The confidentiality attached to this email is not
waived, lost or destroyed by reasons of a mistaken delivery to you.

Re[2]: Negative lookaround?

2006-05-18 Thread Robert Menschel

Hello Matt,

Wednesday, May 17, 2006, 4:04:39 PM, you wrote:

MK> Some of the shorter results are:

MK> body  SARE_OBFU_BACK_NUM   m'(?!BACK)\bb\d?a\d?c\d?k\b'i
MK> body  SARE_OBFU_SAVE_NUM   m'(?!save)\bs\d?a\d?v\d?e\b'i
MK> body  SARE_OBFU_SAVINGS_NUM
m'(?!savings)\bs\d?a\d?v\d?i\d?n\d?g\d?s\b'i
MK> body  SARE_OBFU_NUM_YOUR   m'(?!YOUR)\bY\d?O\d?U\d?R\b'i

MK> (why the author used m' instead of / is beyond me, as it serves no purpose 
in
MK> these rules..  but a lot of SARE rules have really weird style so I'll 
chalk it
MK> up to weird style.)

Many obfu rules need to test for letter substitutions, such as \/ for
V.  Those rules need a lot of quoting unless you use a construct like
m'regex' to eliminate that need.  After several passes of "gosh,
that's another one that needs quoting," I got into the habit of always
using m'regex' for any/all obfu rules.

Bob Menschel

Re: URL-encoded hostnames in email links

2006-05-18 Thread John D. Hardin

On Thu, 18 May 2006, Matt Kettler wrote:

> John D. Hardin wrote:
> > Re:  http://isc.sans.org/diary.php?storyid=1342
> > 
> > (1) Are there any rules currently in SA or SARE that will trigger on
> > encoded characters in the hostname part of a URL?
> > 
> > (2) Does the URL extractor for SURBL checks properly deal with
> > URL-encoded hostnames?
> 
> Yes, SA in general deals with most forms of URI encoding.
> 
> The surbl checks are not confused by the use of ".%63%6f%6d" instead of 
> ".com".
> The general SA architecture decodes these long before the surbl rules see it.

Does encoding plain text ([A-Za-z0-9._]) in a URL add any points?

> I also don't understand why this is a new thing to the ISC
> handler's diary. Spammers have been using that trick for a
> LOONG time. It's more common in phishing than spam, but it's
> still common in both.



--
 John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/
 [EMAIL PROTECTED]FALaholic #11174pgpk -a [EMAIL PROTECTED]
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  The problem is when people look at Yahoo, slashdot, or groklaw and
  jump from obvious and correct observations like "Oh my God, this
  place is teeming with utter morons" to incorrect conclusions like
  "there's nothing of value here".-- Al Petrofsky, in Y! SCOX
---

Re: list of rules