You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2006/06/07 05:27:13 UTC
[Bug 4945] New: Add support for open-whois.org
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4945
Summary: Add support for open-whois.org
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Platform: Other
URL: http://open-whois.org
OS/Version: other
Status: NEW
Severity: normal
Priority: P5
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: bugzilla@silverdream.org
bl.open-whois.org is a list of domains registered through anonymous or proxy
domain registration services, such as Katz Domain Trust, Domains by Proxy and
SecureWhois.
There are some example rules here:
<http://open-whois.org/01_openwhois.cf>
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4945] Add support for open-whois.org
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4945
------- Additional Comments From jm@jmason.org 2006-08-02 19:56 -------
ok, I've picked up the new ones then ;)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4945] Add support for open-whois.org
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4945
------- Additional Comments From jm@jmason.org 2006-08-02 09:30 -------
I've added these to my sandbox -- thanks!
let's see how they do in the weekly mass-check ( http://ruleqa.spamassassin.org/
after saturday).
BTW, if they do perform well, note that we won't actually incorporate them into
a release without say-so from the admins of open-whois.org; having a ruleset
enabled by default in SA can cause massive load on the servers, so we'd have to
be sure they're ready for that.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4945] Add support for open-whois.org
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4945
------- Additional Comments From bugzilla@silverdream.org 2006-08-02 19:30 -------
(In reply to comment #3)
> 'There's also a recently updated list of rules at
> http://open-whois.org/01_openwhois.cf (which includes a few extra anonymising
> services)'
>
> yep -- those are the ones I've picked up.
Unless you got them 10 hours ago, they're the old ones. Which reminds me, I
should probably stick a 'date modified' comment in there somewhere..
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4945] Add support for open-whois.org
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4945
------- Additional Comments From bugzilla@silverdream.org 2006-08-02 10:57 -------
(In reply to comment #1)
> I've added these to my sandbox -- thanks!
>
> let's see how they do in the weekly mass-check ( http://ruleqa.spamassassin.org/
> after saturday).
>
> BTW, if they do perform well, note that we won't actually incorporate them into
> a release without say-so from the admins of open-whois.org; having a ruleset
> enabled by default in SA can cause massive load on the servers, so we'd have to
> be sure they're ready for that.
I probably should have made it clearer that I'm the admin of open-whois.org :)
There's also a recently updated list of rules at
http://open-whois.org/01_openwhois.cf (which includes a few extra anonymising
services)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
Re: [Bug 4945] Add support for open-whois.org
Posted by Michael Monnerie <mi...@it-management.at>.
On Mittwoch, 2. August 2006 14:11
bugzilla-daemon@bugzilla.spamassassin.org wrote:
> 'There's also a recently updated list of rules at
> http://open-whois.org/01_openwhois.cf (which includes a few extra
> anonymising services)'
Is there a channel for this ruleset to use with sa-update?
mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0676/846 914 666 .network.your.ideas.
// PGP Key: "curl -s http://zmi.at/zmi4.asc | gpg --import"
// Fingerprint: EA39 8918 EDFF 0A68 ACFB 11B7 BA2D 060F 1C6F E6B0
// Keyserver: www.keyserver.net Key-ID: 1C6FE6B0
[Bug 4945] Add support for open-whois.org
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4945
------- Additional Comments From jm@jmason.org 2006-08-02 12:11 -------
'I probably should have made it clearer that I'm the admin of open-whois.org :)'
ok, that's cool then ;)
'There's also a recently updated list of rules at
http://open-whois.org/01_openwhois.cf (which includes a few extra anonymising
services)'
yep -- those are the ones I've picked up.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4945] Add support for open-whois.org
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4945
jm@jmason.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
Target Milestone|Undefined |3.2.0
------- Additional Comments From jm@jmason.org 2006-10-12 06:04 -------
in recent mass-checks, these have been doing nicely:
http://ruleqa.spamassassin.org/?daterev=20061007-r453869-n&s_defcorpus=on&rule=&srcpath=sandbox%2Fjm%2F20_openwhois&s_zero=on&s_detail=checked+&g=Change
These are good:
MSECS SPAM% HAM% S/O% RANK SCORE NAME
0.00000 1.4394 3766 of 261633 messages 0.0000 0 messages 1.000 0.84 0.00
T_WHOIS_AITPRIV
0.00000 1.1310 2960 of 261633 messages 0.0064 5 of 62951 messages 0.994
0.81 0.00 T_WHOIS_PRIVPROT
0.00000 0.7407 1938 of 261633 messages 0.0032 3 of 62951 messages 0.996
0.78 0.00 T_DNS_FROM_OPENWHOIS
0.00000 0.2389 626 of 261633 messages 0.0000 0 messages 1.000 0.66 0.00
T_WHOIS_SECUREWHOIS
0.00000 0.1697 444 of 261633 messages 0.0016 1 of 62951 messages 0.991
0.62 0.00 T_WHOIS_WHOISGUARD
0.00000 0.1407 369 of 261633 messages 0.0000 0 messages 1.000 0.60 0.00
T_WHOIS_REGISTERFLY
0.00000 0.1173 307 of 261633 messages 0.0000 0 messages 1.000 0.58 0.00
T_WHOIS_NAMEKING
and these don't really hit enough spam, or hit too much ham:
0.00000 0.1888 494 of 261633 messages 0.0683 43 of 62951 messages 0.734
0.57 0.00 T_WHOIS_DMNBYPROXY
0.00000 0.0520 137 of 261633 messages 0.0032 3 of 62951 messages 0.942
0.51 0.00 T_WHOIS_UNLISTED
0.00000 0.0084 22 of 261633 messages 0.0000 0 messages 1.000 0.45 0.00
T_WHOIS_PRIVACYPOST
0.00000 0.0031 9 of 261633 messages 0.0000 0 messages 1.000 0.45 0.00
T_WHOIS_GKGPROXY
0.00000 0.0023 7 of 261633 messages 0.0000 0 messages 1.000 0.44 0.00
T_WHOIS_WHOISPROT
0.00000 0.0019 5 of 261633 messages 0.0000 0 messages 1.000 0.44 0.00
T_WHOIS_SECINFOSERV
0.00000 0.0011 3 of 261633 messages 0.0000 0 messages 1.000 0.44 0.00
T_WHOIS_NOLDC
0.00000 0.0019 5 of 261633 messages 0.0016 1 of 62951 messages 0.546
0.44 0.00 T_WHOIS_MONIKER_PRIV
0.00000 0.0008 3 of 261633 messages 0.0000 0 messages 1.000 0.44 0.00
T_WHOIS_SPAMFREE
0.00000 0.0008 3 of 261633 messages 0.0000 0 messages 1.000 0.44 0.00
T_WHOIS_CONTACTPRIV
0.00000 0.0191 50 of 261633 messages 0.1048 66 of 62951 messages 0.154
0.38 0.00 T_WHOIS_MYPRIVREG
0.00000 0.1242 325 of 261633 messages 0.5449 344 of 62951 messages 0.186
0.31 0.00 T_WHOIS_NETSOLPR
I guess that's entirely to be expected. ;)
the high scoring ones seem to have correlations to specific spammers or spam
gangs; e.g. one of the rules overlaps noticeably with a specific URL format!
The next issue is one for us -- we need to figure out how to publish these,
since we obv can't promote all the rules. ideally, we could leave the nightly
rule-promotion code to do it. However, right now it is not allowed to
auto-promote network rules, since they are too "heavyweight" in impact.
what I've done is just insert 'publish NAMEOFRULE' lines for the good ones
above... that works, but will require occasional revisiting as hitrates change :(
anyway, they're in now! marking fixed...
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4945] Add support for open-whois.org
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4945
parkerm@pobox.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|normal |enhancement
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.