You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris Santerre <cs...@MerchantsOverseas.com> on 2009/12/15 20:37:15 UTC

icontact random tracking urls and scoring on unwanted TLDs

A few months back there was a wave of spam coming from abused Polish .pl
TLD. I know a few of you who don't do business with that area have written
rules to tag as spam. Many might even use .ru for russian spam if they don't
do business with them. Well today I had an FP. 

It seems iContact uses random generated directories in thier tracking URLs
that contain a period. Yup... you guessed it... incontact/a.pl/xxxxxxxx
means it hits the rule. I've contacted them about the folly. They seemed
receptive. 

Yeah yeah... I know... "But iContact is blocked on site on my network..."
blah blah... 

I'm just passing the info along :) 

Thanks,

Chris Santerre
SysAdmin and Spamfighter

Re: icontact random tracking urls and scoring on unwanted TLDs

Posted by RW <rw...@googlemail.com>.
On Tue, 15 Dec 2009 14:37:15 -0500
Chris Santerre <cs...@MerchantsOverseas.com> wrote:

> It seems iContact uses random generated directories in thier tracking
> URLs that contain a period. Yup... you guessed it...
> incontact/a.pl/xxxxxxxx means it hits the rule. I've contacted them
> about the folly. They seemed receptive. 

I think it's unfair to talk about their folly or even mention it to
them.  By the sound of it it's entirely your fault because you
matched the .pl beyond a "/"

Re: icontact random tracking urls and scoring on unwanted TLDs

Posted by Charles Gregory <cg...@hwcn.org>.
On Tue, 15 Dec 2009, Chris Santerre wrote:
> A few months back there was a wave of spam coming from abused Polish .pl
> TLD.
> It seems iContact uses random generated directories in thier tracking URLs
> that contain a period. Yup... you guessed it... incontact/a.pl/xxxxxxxx
> means it hits the rule.

The wide variation of possible page names, plus cgi parameters obliges us
to 'tighten' our URI regexes....

uri LOC_RU_URI /^(http:\/\/|mailto:)?[^\/\?]+\.ru/

This will only look for '.ru' before any slash or question mark that would 
delineate the end of the domain name portion of the URI.

- C