> -----Original Message-----
> From: Yves Goergen [mailto:[EMAIL PROTECTED]]
> Sent: Sunday, June 18, 2006 5:46 AM
> To: Loren Wilton
> Cc: users@spamassassin.apache.org
> Subject: Re: Adding Phishing Link rule
>
>
> On 18.06.2006 03:51 CE(S)T, Loren Wilton wrote:
> > The rule you suggest isn't particularly good. There are
> far too many legit
> > mails (mostly mailing list type of things) that do exactly
> what you want to
> > check for. So the FP rate is higher than most people would like.
>
> However, I haven't seen this type of link before and I cannot tolerate
> people showing explicit URLs in a link label but actually linking
> somewhere else. This rule, as so many, isn't intended to
> block a message
> on its own, but gives its part to the score.
>
> > That said, I believe there is at least one SARE rule that
> checks for exactly
> > what you want to look for.
>
> Now that I know what SARE is, it doesn't make the impression of a
> considerable archive to me, with respect to this issue.
Say what??? Its not really a discussion list type setup. If you mean the forums, hell even I haven't looked at them in ages :)
Loren meant that there is already a rule written by SARE for exactly what you are looking for. You just need to find it. I'll see if I can.
>
> Still I don't know how to create a rule like this. But as someone else
> in the bug tracker already mentioned a year ago, what SpamAssassin
> misses to do things like that is a 'rawbody' match that uses
> the entire
> message, not only single lines. Content can be arbitrary
> split over many
> lines so that any 'rawbody' rule can become useless pretty fast. :(
Why not just use black.uribl.com ? It lists PHISHes.
Chris Santerre
SysAdmin and SARE/URIBL ninja
http://www.uribl.com
http://www.rulesemporium.com
