Re: [SAtalk] Re: Obfusticated URI?

2004-01-14 Thread Larry Starr
On Wednesday 14 January 2004 08:33 am, Brent J. Nordquist wrote: > On Tue, 13 Jan 2004, Larry Starr <[EMAIL PROTECTED]> wrote: > > uri FCS_URI_NODOTS /^[^\.]*$/ > > describeFCS_URI_NODOTS URI found with no Dots (.) > > score FCS_URI_NODOTS

[SAtalk] Re: Obfusticated URI?

2004-01-13 Thread Larry Starr
On Monday 12 January 2004 03:39 pm, Larry Starr wrote: > Just noticed a message with an encoded URL, that misses, the "BIZ_TLD" > rule, etc. > > The message body contains: > http://gf=2eclearmath=2ebiz/jsimp/index=2ehtml";> face=3d"arial">scored thi

[SAtalk] Obfusticated URI?

2004-01-12 Thread Larry Starr
Just noticed a message with an encoded URL, that misses, the "BIZ_TLD" rule, etc. The message body contains: http://gf=2eclearmath=2ebiz/jsimp/index=2ehtml";>scored this way=2e http://K=2eclearmath=2ebiz/images/js02=2ejpg"; border=3d= "0"> I know this wraps a bit ugly, when pasted into my mai

[SAtalk] Detecting strings of Gibberish

2003-12-11 Thread Larry Starr
I have noticed that many SPAM emails, end with seversl lines of gibberish, such as: lvwpdfobv qkviylqr qlmwacbc hpimhdty mdmrkb lvivhdc xovwul wpcxeqj lhaxomaje vrucjj ybxegs Has anyone developed a rule that can detect this sort of thing? Perhaps a check for consecuti

Re: [SAtalk] sa-learn mbox processing? (forwarded learning)

2003-12-10 Thread Larry Starr
On Wednesday 10 December 2003 12:10 pm, Matt Kettler wrote: > At 11:32 AM 12/10/2003, Larry Starr wrote: > >My question regards scripts to ease processing of these mailboxes. Since > > the messages are forwarded, from several different Email clients > > (netscape, kmail,

[SAtalk] sa-learn mbox processing?

2003-12-10 Thread Larry Starr
I currently have mimedefang (2.37) and spamassassin (2.60) running on a RH9 mail gateway. Spamassassin is configured to block messages with a very high SA score and to tag and pass along everything else. I have two accounts set up, on an internal server, for users to forward received spam, and