[Bug 7083] New: Match anonymized/masked hosts

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7083

            Bug ID: 7083
           Summary: Match anonymized/masked hosts
           Product: Spamassassin
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: Rules
          Assignee: dev@spamassassin.apache.org
          Reporter: bugzilla77@free.fr

90% of the SPAM that gets through rules are links to masked domains sent
through snowhoe hosts.

A rule to match masked domains using non compliant companies (ex: resolving to
cloudflare) in body would be a good signal.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 7083] Match anonymized/masked hosts

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7083

bugzilla77@free.fr changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bugzilla77@free.fr

--- Comment #2 from bugzilla77@free.fr ---
Masked domains are proxied domains, ie points to a different ip than the
original server.

Some companies providing this service will never reveal original IP on abuse
(ex: cloudflare) whatever the criminal activity is. crimeflare.com has a
description of this.

This is why this is now the preferred spammers way to spamvertise websites as
the target website will always be running and proxyer will never shut down
redirection (spam not coming from them...). They just need to snowhoe and post
a link to that content or include asset from those hosts.

Although proxying could be legitimate for some reasons, that could also be used
as a signal, especially with no real body content.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 7083] Match anonymized/masked hosts

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7083

AXB <ax...@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |INVALID

--- Comment #1 from AXB <ax...@gmail.com> ---
what are "masked domains" ? and how are they any different  than any other?

what is non compliant about cloudflare?
what do you propose?

As it is not clear what you request, please move the discussion to the user or
dev list.
This is not a bug or well specified feature request

-- 
You are receiving this mail because:
You are the assignee for the bug.