You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Billy Huddleston <bi...@nxs.net> on 2006/01/05 05:16:46 UTC

URI's and geocities subwebs..

Is their a way to get the URI's to look at stuff like this??  I'm seeing more and more spam with these kinds of things in them to get by URI detection..

http://asia.geocities.com/april19781matt1487

Thanks, Billy

Re: URI's and geocities subwebs..

Posted by Jon Kvebaek <jk...@klanen.no>.
Quoting Billy Huddleston <bi...@nxs.net>:

> Is their a way to get the URI's to look at stuff like this??  I'm
> seeing more and more spam with these kinds of things in them to get
> by URI detection..
> 
> http://asia.geocities.com/april19781matt1487

I am seeing a lot of them as well, and now with other URLs than
geocities.

They all have one thing in common - they look like normal forwarded mail
with an URL in it. Not easy to stay ahead of this kind of trash.

-- 
Jon Kvebaek <jk...@klanen.no>
Mobil: +47 992 19 829
Unanimiter et constanter Oslo

Re: URI's and geocities subwebs..

Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
On 05/01/2006 11:23 AM, Matt Kettler wrote:
> Billy Huddleston wrote:
> 
>>Is their a way to get the URI's to look at stuff like this??  I'm seeing
>>more and more spam with these kinds of things in them to get by URI
>>detection..
>> 
>>http://asia.geocities.com/april19781matt1487
>> 
> 
> 
> Do you mean URIBL's? Not likely without major change.. URIBLs only look up the
> domain name, not the subdomain, and not the path.
> 
> To SA's URIBL tests, the above is just "geocities.com".
> 
> This kind of thing is currently best covered by SARE's specific and uri rulesets.

If you can bear an HTTP query on the Geocities URIs, I've had excellent 
results over the last four or five months with my WebRedirect plugin.

http://wiki.apache.org/spamassassin/WebRedirectPlugin


Daryl

Re: URI's and geocities subwebs..

Posted by Matt Kettler <mk...@evi-inc.com>.
Billy Huddleston wrote:
> Is their a way to get the URI's to look at stuff like this??  I'm seeing
> more and more spam with these kinds of things in them to get by URI
> detection..
>  
> http://asia.geocities.com/april19781matt1487
>  

Do you mean URIBL's? Not likely without major change.. URIBLs only look up the
domain name, not the subdomain, and not the path.

To SA's URIBL tests, the above is just "geocities.com".

This kind of thing is currently best covered by SARE's specific and uri rulesets.