On Wed, Jun 06, 2001, Adi Stav wrote about "Re: Intresting Strange Address - Not Linux
Q":
> On Tue, Jun 05, 2001 at 02:17:26PM +0300, Haim Gelfenbeyn wrote:
> > As you know IP address in just 32-bit number. Many browsers (including
> > NS and IE4+ as far as I know) support both the regilar
> > "number.dot.number..." form and specifying IP as-is (e.g. as 32-bit
>...
Because these forms of addresses are popular with spammers (I have no
idea why - supposedly because it confuses most people, and these people
don't know who to compain to), die-hard anti-spammers always have a
simple program (like someone posted here), or an online tool to
de-obfuscate such URLs.
The most well-known online tool of that type is Sam Spade (www.samspade.org)
One of the tools there is "decypher": you enter "http://3475622417/";, press
"decypher", and you get:
3475622417 is just another way of writing the IP address 207.41.202.17
> And for a good reason. Such nasties are often used by spammers to
> know which of the people they sent spam to actually click spam links,
> so that they can put them on their "extra preferred customers" list.
> Sorry. Well, you can always change your email address... Or ask Nadav
> for his uberscripts :)
Actually, catching this case is trivial. Since nobody in their right mind
(i.e., nobody except spammers) actually uses such a weird URL in an email,
the mere presence of one indicates that this email is spam! So do something
like this (this example is in procmailrc format):
:0 BH:
*(^|\<)http://[0-9][0-9][0-9][0-9]
spam
Unfortunately, that covers only about 0.1% of the lines in my "uberscripts",
as you call them; It only catches spam once in a while - other methods must
be used to catch most spam.
BTW, us anti-spammers suffered a big blow a few days ago, when ORBS
(orbs.org), the open relay realtime blacklist, shut down. The reasons
are still unclear - some claim that it has to do with a lawsuit against
the person running ORBS, and some claim it's because the ISP he owns went
out of business. So now we're stuck with (lower quality in my opinion) RSS
(mail-abuse.org) for finding open relays... Luckily my spam-filters are
quite redundant so I still get nearly 100% spam eradication, but the filters
are now much less redundant :(
--
Nadav Har'El | Tuesday, Jun 5 2001, 15 Sivan 5761
[EMAIL PROTECTED] |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |A computer program does what you tell it
http://nadav.harel.org.il |to do, not what you want it to do.
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
