*Apologies if you've already seen this - I can't find any indication that it sent when I hit send and I'm fooling with a new mail client*
On Fri, 10 Feb 2006 11:21:25 -0500, you wrote: >I think I know a bit about extracting URLs from spam ;) A bit. <massive understatement> >It is pretty damn complicated. A lot of tricks they play, like >www.amazon.com.buy-my-drugs-com.optelnd.net > >Then you have hex and decimal links to deal with. And yeah, they do pepper >the spam with legit urls. What about akami image links? Its was common to >see 20 links in a spam, and only one was the evil one you wanted. > >Automation without a LOT of checks and balances = FPs. > >You have to have a LOT more autoresearched evidence then just that they are >contained in a spam. But hey! A+ for effort! Its a start, and it will always >get better. xurl is designed to deal with the rare spam that makes it thru my SA/amavisd/clam setup... In the (relatively small) sample of spams I worked from (not much makes it thru all that), I didn't encounter anything xurl would create FPs from - mainly what makes it thru my current setup is one or two lines of glop (bayes poison) and an url. xurl is only designed to clean up the dust behind SA - in NO WAY is it supposed to be a front line defense. Mike- -- If you're not confused, you're not trying hard enough. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at catherders.com. If email from you bounces, try non-HTML, non-encoded, non-attachments,
