I can see how using image references could be problematic... just because an image is referenced, it doesn't mean the spammer controls it. Personally, for my home grown additions to the evil list, I've been adding only the domains or IPs that the spammer wants me to click on... but even this can lead to FPs if you're not careful.
For example, I get a few "Stock Pick" spams that reference legitimate quote sites... they don't necessarily want you to respond directly to them, they just want you to buy their stock. --jenni On Thu, 4 Dec 2003, Damian Gerow wrote: > Thus spake Chris Santerre ([EMAIL PROTECTED]) [04/12/03 16:48]: > > That is the problem we are now facing. Would a spammer need high volume web > > access? My corpa says yes. I obviously can't tag this now. I removed the > > first 2, but I have left bfast.com and xmr3.com in for now. I may remove > > tomorrow. I need to think about some things tonight. I'm thinking these will > > go in a comment out rule. Mabye a rule 999 that is scored .01 so people can > > see it had one of these and report it to the host? > > Yes, a spammer would need high availability. But so does Microsoft, Apple, > CBC (Canadian Broadcasting Corporation), etc. Again, just because an image > is hosted by Akamai doesn't even mean that Akamai is aware of this -- it > just means that someone who may or may not be paying Akamia either found an > image hosted by them, or put an image up, and is referencing it in their > spam. > > It's akin to someone sending spam using your address in the From: field -- > I'm not going to blacklist you because you were Joe-Jobbed, nor should I be > blacklisting a company because their webiste was Joe Jobbed. > > I man the abuse desk here, and at least once a week, I get a spam complaint, > due to a spamvertised website. Looking over the spam shows, usually, about > a hundred or so websites included, that have nothing to do with each other > -- they look like they were included to confuse places like SpamCop, or any > domain whitelisting that may be done. > > > When I actually start updating this with new domains, strict testing is > > going to be done. I'm not liking these hosts playing both sides of the > > field. > > It's tough, but your decision is simple: Zero False Positives means that > these sites can't be listed. > > I'm not affiliated with Akamai, but I do work with them (we have a > three-host rack here as well). I've seen them give me my Windows Updates > when Microsoft was crawling, I've seen them mitigate DoS attacks, and I can > get my Apple trailers a heck of a lot faster... ;) > > Trust me, Akamai is a Good Thing(tm). > > - Damian > > > ------------------------------------------------------- > This SF.net email is sponsored by: IBM Linux Tutorials. > Become an expert in LINUX or just sharpen your skills. Sign up for IBM's > Free Linux Tutorials. Learn everything from the bash shell to sys admin. > Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
