Jump to content

ekolve

Members
  • Content Count

    5
  • Joined

  • Last visited

Community Reputation

0 Neutral

About ekolve

  • Rank
    Newbie
  1. Here is scoring I do for spamcop urls in spamassassin: score SPAMCOP_HOST_URI 1.25 score SPAMCOP_URI 2.5 So if the full url appears in the list, it gets a score of 3.75, which is still below the default threshold of 5.0 of spam. If just the host appears, then it gets 1.25 points. You could probably raise these values without worry of FPs, but I am pretty happy with the results I have been getting. --eric
  2. What does 'IB' stand for? --eric
  3. I have emailed both julian and jeffg, without any success (Jeff G pointed me to julian). I have been using spamcopuri on my own machine where I received 100 spams per day. Around 50 - 60% of these have URLs listed on spamcop's list. Jeff Chan is behind the SURBL and I am looking in to helping him out a bit with this effort as well. One user commented that they cannot be sure whether the URLs they report are 100% innocent or not, which raises some concerns. I do think this is a very reliable way of blocking spam and if we cannot do it through spamcop, another site should be started to allow people to report URLs in a similar fashion. --eric
  4. I have created a package for this at sourceforge. You can download it at: http://www.sourceforge.net/projects/spamcopuri/ --eric
  5. I created something to do this a couple of months ago and integrated it in to spamassassin. I should probably shoot them an email, though its kind of klugy since its scraping the spamvertised sites off of spamcop.net periodically. If anyone is interested, let me know and I will post the code. I basically use WWW::Mechanize to grab http://www.spamcop.net/w3m?action=inprogress&type=www every so often and pull all the links and output a file called spamcop_url.cf which lives under /etc/mail/spamassassin/. This gets picked up when a mail is checked for spam. An entry in the conf file looks something like: uri SPAMCOP_NET_URI_5 /http\:\/\/www\.1callerid\.com\/rm\/index\.html/i describe SPAMCOP_NET_URI_5 Matches SPAMCOP URI http://www.1callerid.com/rm/index.html (generated: Thu Feb 12 18:00:01 PST 2004) score SPAMCOP_NET_URI_5 1.80 I keep one day back of urls in a serialized file using storable. This has worked pretty well and definitely increased the number of points that spams receive. I think a better approach would be one where spamcop or some other service were to provide a URL that you could pass a URI and it would tell you whether its been banned, how many have reported, how long, etc. The spamfilter would then decide how many points to give it based on those params. I think this could not only be effective with links, but also with images as well, since that is how some spams seep through. The only downside to this is the service may need to get intelligent since spammers would use wildcard A DNS records, so it would have to resolve the ip of the host instead of just doing a string comparison against what was passed in. If someone is willing to give me hosting space, i would be happy to consider working on the service. --eric
×