You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Igor Chudov <ig...@chudov.com> on 2014/11/23 03:37:40 UTC
Emails with extremely long URLs
I receive spam emails that contain extremely long URLs, about 2,400
characters. I wanted to know if spamassassin has a rule that I can
turn on to flag such URLs. I do not think that I ever receive
legitimate emails with URLs that long.
i
Re: Emails with extremely long URLs
Posted by Noel Butler <no...@ausics.net>.
On 24/11/2014 00:07, Igor Chudov wrote:
> On Sat, Nov 22, 2014 at 07:16:38PM -0800, John Hardin wrote:
> On Sat, 22 Nov 2014, Igor Chudov wrote: I receive spam emails that contain extremely long URLs, about 2,400 characters. I wanted to know if spamassassin has a rule that I can turn on to flag such URLs. I do not think that I ever receive legitimate emails with URLs that long. I don't think there's anything in the base rules but that should be pretty simple: uri URI_ABSURDLY_LONG /.{2000}/ Care to post a spample to pastebin?
Thanks. I do not currently have a sample. I will keep an eye on
them. They are MIME emails with junk plaintext content, and enormous
URLs in the html part.
Igor
As dumb, stupid, and ridiculous as it sounds, 2K chars is actually a
perfectly valid URL value
IIRC, most browsers accept up to 2100 or there abouts, but to put such a
URL in an email, would be asking for spam :)
Re: Emails with extremely long URLs
Posted by Igor Chudov <ig...@chudov.com>.
On Sat, Nov 22, 2014 at 07:16:38PM -0800, John Hardin wrote:
> On Sat, 22 Nov 2014, Igor Chudov wrote:
>
> >I receive spam emails that contain extremely long URLs, about 2,400
> >characters. I wanted to know if spamassassin has a rule that I can
> >turn on to flag such URLs. I do not think that I ever receive
> >legitimate emails with URLs that long.
>
> I don't think there's anything in the base rules but that should be
> pretty simple:
>
> uri URI_ABSURDLY_LONG /.{2000}/
>
> Care to post a spample to pastebin?
>
Thanks. I do not currently have a sample. I will keep an eye on
them. They are MIME emails with junk plaintext content, and enormous
URLs in the html part.
Igor
Re: Emails with extremely long URLs
Posted by Adam Katz <an...@khopis.com>.
On 11/22/2014 07:16 PM PST, John Hardin wrote:
> On Sat, 22 Nov 2014, Igor Chudov wrote:
>> I receive spam emails that contain extremely long URLs, about 2,400
>> characters. I wanted to know if spamassassin has a rule that I can
>> turn on to flag such URLs. I do not think that I ever receive
>> legitimate emails with URLs that long.
>
> I don't think there's anything in the base rules but that should be
> pretty simple:
>
> uri URI_ABSURDLY_LONG /.{2000}/
There was a similar request on Stack Overflow
<https://stackoverflow.com/questions/26478828/spamassassin-regex-to-catch-long-url>
recently. It had the extra requirement of satisfying TLDs that SA uri
rules cannot yet extract from bodies, but the stats I gave are actually
based on uri rules.
An excerpt from my answer on 2014/11/13:
> That will technically work, though I'm sure you'll find it fires on a
> LOT of non-spam, marketing mail in particular [...]
>
> No size range is going to have a terribly good spam:ham ratio (an S/O
> <https://wiki.apache.org/spamassassin/HitFrequencies#The_S.2FO_Ratio>,
> aka precision <https://en.wikipedia.org/wiki/Precision_and_recall>, of
> 0.900 is possibly acceptable, but you really want to be closer to
> 1.000). By my tests, the best range is 192-256 characters, but even
> that is too weak (S/O of 0.862 in my data) to be terribly useful.
> There is almost no spam using a link with over 1024 characters (S/O of
> 0.057 for me).
That S/O is still true (it's S/O is now 0.054 and its spam hit rate
remains below 0.01%). At 2000+ chars, the S/O is still quite low, as
are the independent volumes of spam and ham. Volume of all mail
containing 1024+ character URLs has increased slightly in the past few
months, from roughly 0.10% to 0.15%. This increase has been slightly
more among ham than spam.
Re: Emails with extremely long URLs
Posted by John Hardin <jh...@impsec.org>.
On Sat, 22 Nov 2014, Igor Chudov wrote:
> I receive spam emails that contain extremely long URLs, about 2,400
> characters. I wanted to know if spamassassin has a rule that I can
> turn on to flag such URLs. I do not think that I ever receive
> legitimate emails with URLs that long.
I don't think there's anything in the base rules but that should be pretty
simple:
uri URI_ABSURDLY_LONG /.{2000}/
Care to post a spample to pastebin?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Yet another example of a Mexican doing a job Americans are
unwilling to do. -- Reno Sepulveda, on UniVision reporters asking
President Obama some pointed questions about
the BATFE Fast and Furious scandal.
-----------------------------------------------------------------------
905 days since the first successful private support mission to ISS (SpaceX)