> -Original Message-
> From: jdow [mailto:j...@earthlink.net]
>
> {^_-} (Some of the ninjas are burned out. I have one such to my
> back when we're both in the room beating away at our CPUs.)
>
+1 burnout. Too many things going on. Will eventually get my 232nd wind and
be ba
From: "MySQL Student"
Sent: Sunday, 2009/October/11 09:08
Hi,
We use some rules if we talk open about it and say hey this spammer is
stupid look here, then it will take less then 12 hours and that gap is
closed and we loose a valuable trick.
yes its the way it is, spammers can also read ma
Hi,
>> We use some rules if we talk open about it and say hey this spammer is
>> stupid look here, then it will take less then 12 hours and that gap is
>> closed and we loose a valuable trick.
>
> yes its the way it is, spammers can also read maillists and adapt there
> spamming rules to get bypas
On søn 11 okt 2009 12:12:20 CEST, jdow wrote
could squeeze his spam decreased. It's still decreasing, although at a
slower rate due to the relative inactivity of the SARE ninjas.
sare rules is non maintained now, but it could still go to masscheck
to get the best of them readded in to sa
--
On søn 11 okt 2009 11:48:11 CEST, Raymond Dijkxhoorn wrote
We use some rules if we talk open about it and say hey this spammer
is stupid look here, then it will take less then 12 hours and that
gap is closed and we loose a valuable trick.
yes its the way it is, spammers can also read mailli
Hi!
So I am quite aware of losing good rules. HOWEVER, as he found out WE
keep the old rules and add new ones and his keyhole through which he
could squeeze his spam decreased. It's still decreasing, although at a
slower rate due to the relative inactivity of the SARE ninjas.
Most Ninja's incl
From: "Raymond Dijkxhoorn"
Sent: Sunday, 2009/October/11 02:48
Hi!
7263 T_CN_URL hits in 15517 spam corpus
7200 T_CN_8_URL hits in 15517 spam corpus
Does this make any sense? This is funny. Could someone add this rule
to the sandbox? I'm just curious.
I have to admire one thing about
Hi!
7263 T_CN_URL hits in 15517 spam corpus
7200 T_CN_8_URL hits in 15517 spam corpus
Does this make any sense? This is funny. Could someone add this rule to
the sandbox? I'm just curious.
I have to admire one thing about spammers. They respond very rapidly to
"threats" to their ability
On 10/11/2009 02:07 AM, jdow wrote:
I have to admire one thing about spammers. They respond very rapidly to
"threats" to their ability to break through spam protection software. You
became curious and mentioned this on the date above. Spammers are already
using <7 character names>.cn.
{^_-}
Y
From: "Warren Togami"
Sent: Wednesday, 2009/September/30 21:40
uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i
describe T_CN_URL Contains a URL in the .cn domain
uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i
describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8
characters long
h
On Sun, 4 Oct 2009, Warren Togami wrote:
On 10/04/2009 04:07 PM, John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
> The "Oddity" I was pointing out at the beginning of the thread is not
> prevalence of .cn URI's, but rather most of them appear to be exactly
> 8 characters long.
On 10/04/2009 04:07 PM, John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
The "Oddity" I was pointing out at the beginning of the thread is not
prevalence of .cn URI's, but rather most of them appear to be exactly
8 characters long.
Are there any other .cn domain formats (like {8}.c
On Thu, 1 Oct 2009, Warren Togami wrote:
The "Oddity" I was pointing out at the beginning of the thread is not
prevalence of .cn URI's, but rather most of them appear to be exactly 8
characters long.
Are there any other .cn domain formats (like {8}.com.cn) that would be of
interest? I was tr
On Sun, 4 Oct 2009, Karsten Br?ckelmann wrote:
On Sun, 2009-10-04 at 09:59 -0400, Warren Togami wrote:
On 10/04/2009 12:21 AM, John Hardin wrote:
Right, in adding things to the sandbox it does not necessarily mean I
suggest they should become rules. I am mainly curious to see what the
result
On Sun, 2009-10-04 at 09:59 -0400, Warren Togami wrote:
> On 10/04/2009 12:21 AM, John Hardin wrote:
> > > Right, in adding things to the sandbox it does not necessarily mean I
> > > suggest they should become rules. I am mainly curious to see what the
> > > results say.
> >
> > Warning: autopromo
On 10/04/2009 12:21 AM, John Hardin wrote:
On Sat, 3 Oct 2009, Warren Togami wrote:
On 10/03/2009 07:50 PM, Adam Katz wrote:
8 is *extremely* important in Chinese culture. When running these
tests, make sure that there is a good quantity of .cn TLD URIs in the
ham before drawing any conclusio
On Sat, 3 Oct 2009, Warren Togami wrote:
On 10/03/2009 07:11 PM, John Hardin wrote:
> [^./]{8}\.cn
>
> Actually, doesn't this match other characters that shouldn't be in a
> domain name?
...is _anything_ (apart from periods) excluded from domain names these
days? :)
Changed to \w{8} f
On Sat, 3 Oct 2009, Warren Togami wrote:
On 10/03/2009 07:50 PM, Adam Katz wrote:
8 is *extremely* important in Chinese culture. When running these
tests, make sure that there is a good quantity of .cn TLD URIs in the
ham before drawing any conclusions.
Right, in adding things to the san
On 10/03/2009 07:11 PM, John Hardin wrote:
[^./]{8}\.cn
Actually, doesn't this match other characters that shouldn't be in a
domain name?
...is _anything_ (apart from periods) excluded from domain names these
days? :)
Changed to \w{8} for testing. Can you provide examples of needing more
than
On 10/03/2009 07:50 PM, Adam Katz wrote:
8 is *extremely* important in Chinese culture. When running these
tests, make sure that there is a good quantity of .cn TLD URIs in the
ham before drawing any conclusions.
Right, in adding things to the sandbox it does not necessarily mean I
suggest t
Warren Togami wrote:
>>> The "Oddity" I was pointing out at the beginning of the thread is not
>>> prevalence of .cn URI's, but rather most of them appear to be exactly 8
>>> characters long. Could someone please commit my T_CN_8_URL rule to the
>>> sandbox so we can see if that trend holds beyond
On Sat, 3 Oct 2009, Warren Togami wrote:
Can't trust those results yet. The trailing slash bug, and John Rudd
might be correct about whitespace?
I doubt whitespace will be a problem. That would break the parser before
it even got to the rule, and while "dom%20name.cn" might be syntactically
On Sat, Oct 3, 2009 at 15:55, John Hardin wrote:
> On Sat, 3 Oct 2009, John Rudd wrote:
>
>> On Sat, Oct 3, 2009 at 11:06, Warren Togami wrote:
>>
>>>
>>> # 8-letter .cn domain, per Warren Togami
>>> uri CN_EIGHT
>>> m;^https?://(?:[^./]+\.)*[^./]{8}\.cn/;
>>> describe CN_EIGHT
On Sat, 3 Oct 2009, John Rudd wrote:
On Sat, Oct 3, 2009 at 11:06, Warren Togami wrote:
# 8-letter .cn domain, per Warren Togami
uri CN_EIGHT m;^https?://(?:[^./]+\.)*[^./]{8}\.cn/;
describe CN_EIGHT .CN uri with eight-letter domain name
score
On 10/03/2009 05:08 PM, John Hardin wrote:
On Sat, 3 Oct 2009, Warren Togami wrote:
On 10/01/2009 02:36 PM, John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
> The "Oddity" I was pointing out at the beginning of the thread is not
> prevalence of .cn URI's, but rather most of them ap
On Sat, Oct 3, 2009 at 11:06, Warren Togami wrote:
>
> # 8-letter .cn domain, per Warren Togami
> uri CN_EIGHT m;^https?://(?:[^./]+\.)*[^./]{8}\.cn/;
> describe CN_EIGHT .CN uri with eight-letter domain name
> score CN_EIGHT 0.10
>
> Pos
On Sat, 3 Oct 2009, Warren Togami wrote:
On 10/01/2009 02:36 PM, John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
> The "Oddity" I was pointing out at the beginning of the thread is not
> prevalence of .cn URI's, but rather most of them appear to be exactly
> 8 characters long.
On Sat, 3 Oct 2009, Ned Slider wrote:
Warren Togami wrote:
On 10/01/2009 02:36 PM, John Hardin wrote:
> On Thu, 1 Oct 2009, Warren Togami wrote:
>
> > The "Oddity" I was pointing out at the beginning of the thread is
> > not prevalence of .cn URI's, but rather most of them appear to be
>
Warren Togami wrote:
On 10/01/2009 02:36 PM, John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
The "Oddity" I was pointing out at the beginning of the thread is not
prevalence of .cn URI's, but rather most of them appear to be exactly
8 characters long. Could someone please commit my
On 10/01/2009 02:36 PM, John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
The "Oddity" I was pointing out at the beginning of the thread is not
prevalence of .cn URI's, but rather most of them appear to be exactly
8 characters long. Could someone please commit my T_CN_8_URL rule to
th
Hi All,
Regarding the .cn oddity, I added these to my rules, and of about 79k
messages today so far, I have the following:
uri LOC_URI_CN m;^https?://[^/?]+\.cn\b;
uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i
LOC_URI_CN: 2926
T_CN_8_URL: 1634
HTH,
Alex
On Thu, 1 Oct 2009, Warren Togami wrote:
The "Oddity" I was pointing out at the beginning of the thread is not
prevalence of .cn URI's, but rather most of them appear to be exactly 8
characters long. Could someone please commit my T_CN_8_URL rule to the
sandbox so we can see if that trend hol
From: "Ned Slider"
Sent: Thursday, 2009/October/01 10:48
Warren Togami wrote:
On 10/01/2009 01:05 PM, John Hardin wrote:
On Thu, 1 Oct 2009, jdow wrote:
From: "John Hardin"
Yours may still hit .cn in the path part. May I suggest:
m;^https?://[^/?]+\.cn\b;
Regardless of their correctn
From: "Warren Togami"
Sent: Thursday, 2009/October/01 10:24
On 10/01/2009 01:16 PM, Warren Togami wrote:
On 10/01/2009 01:05 PM, John Hardin wrote:
On Thu, 1 Oct 2009, jdow wrote:
From: "John Hardin"
Yours may still hit .cn in the path part. May I suggest:
m;^https?://[^/?]+\.cn\b;
R
Warren Togami wrote:
On 10/01/2009 01:05 PM, John Hardin wrote:
On Thu, 1 Oct 2009, jdow wrote:
From: "John Hardin"
Yours may still hit .cn in the path part. May I suggest:
m;^https?://[^/?]+\.cn\b;
Regardless of their correctness, would you care to expound on the
success
of these two
On 10/01/2009 01:16 PM, Warren Togami wrote:
On 10/01/2009 01:05 PM, John Hardin wrote:
On Thu, 1 Oct 2009, jdow wrote:
From: "John Hardin"
Yours may still hit .cn in the path part. May I suggest:
m;^https?://[^/?]+\.cn\b;
Regardless of their correctness, would you care to expound on the
On 10/01/2009 01:05 PM, John Hardin wrote:
On Thu, 1 Oct 2009, jdow wrote:
From: "John Hardin"
Yours may still hit .cn in the path part. May I suggest:
m;^https?://[^/?]+\.cn\b;
Regardless of their correctness, would you care to expound on the success
of these two rules, John? I like what
On Thu, 1 Oct 2009, jdow wrote:
From: "John Hardin"
Yours may still hit .cn in the path part. May I suggest:
m;^https?://[^/?]+\.cn\b;
Regardless of their correctness, would you care to expound on the success
of these two rules, John? I like what works not political correctness.
I
On Thu, 1 Oct 2009, Benny Pedersen wrote:
On tor 01 okt 2009 18:26:01 CEST, John Hardin wrote
m;^https?://[^/?]+\.cn\b;
replace ; with / no ?
m/\bhttps?://[^/?]+\.cn\b/i
No. The point to m; is so that you can embed / in the RE without escaping
them. You are changing the RE delimiters.
m
From: "John Hardin"
Sent: Thursday, 2009/October/01 09:26
On Thu, 1 Oct 2009, Ned Slider wrote:
John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
> uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i
> describe T_CN_URL Contains a URL in the .cn domain
>
> uri T_CN_8_URL /[\/.]+\
On tor 01 okt 2009 18:26:01 CEST, John Hardin wrote
m;^https?://[^/?]+\.cn\b;
replace ; with / no ?
m/\bhttps?://[^/?]+\.cn\b/i
--
xpoint
On Thu, 1 Oct 2009, Ned Slider wrote:
John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
> uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i
> describe T_CN_URL Contains a URL in the .cn domain
>
> uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i
> describe T_CN_8_URL Contains a URL i
John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i
describe T_CN_URL Contains a URL in the .cn domain
uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i
describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8
characters long
http:
On Thu, 1 Oct 2009, Warren Togami wrote:
uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i
describe T_CN_URL Contains a URL in the .cn domain
uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i
describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8 characters
long
http://ruleqa.spamassassi
uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i
describe T_CN_URL Contains a URL in the .cn domain
uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i
describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8
characters long
http://ruleqa.spamassassin.org/20090930-r820211-n/T_CN_URL/detail
La
45 matches
Mail list logo
