RE: .cn Oddity

2009-10-13 Thread Chris Santerre
> -Original Message- > From: jdow [mailto:j...@earthlink.net] > > {^_-} (Some of the ninjas are burned out. I have one such to my > back when we're both in the room beating away at our CPUs.) > +1 burnout. Too many things going on. Will eventually get my 232nd wind and be ba

Re: .cn Oddity

2009-10-11 Thread jdow
From: "MySQL Student" Sent: Sunday, 2009/October/11 09:08 Hi, We use some rules if we talk open about it and say hey this spammer is stupid look here, then it will take less then 12 hours and that gap is closed and we loose a valuable trick. yes its the way it is, spammers can also read ma

Re: .cn Oddity

2009-10-11 Thread MySQL Student
Hi, >> We use some rules if we talk open about it and say hey this spammer is >> stupid look here, then it will take less then 12 hours and that gap is >> closed and we loose a valuable trick. > > yes its the way it is, spammers can also read maillists and adapt there > spamming rules to get bypas

Re: .cn Oddity

2009-10-11 Thread Benny Pedersen
On søn 11 okt 2009 12:12:20 CEST, jdow wrote could squeeze his spam decreased. It's still decreasing, although at a slower rate due to the relative inactivity of the SARE ninjas. sare rules is non maintained now, but it could still go to masscheck to get the best of them readded in to sa --

Re: .cn Oddity

2009-10-11 Thread Benny Pedersen
On søn 11 okt 2009 11:48:11 CEST, Raymond Dijkxhoorn wrote We use some rules if we talk open about it and say hey this spammer is stupid look here, then it will take less then 12 hours and that gap is closed and we loose a valuable trick. yes its the way it is, spammers can also read mailli

Re: .cn Oddity

2009-10-11 Thread Raymond Dijkxhoorn
Hi! So I am quite aware of losing good rules. HOWEVER, as he found out WE keep the old rules and add new ones and his keyhole through which he could squeeze his spam decreased. It's still decreasing, although at a slower rate due to the relative inactivity of the SARE ninjas. Most Ninja's incl

Re: .cn Oddity

2009-10-11 Thread jdow
From: "Raymond Dijkxhoorn" Sent: Sunday, 2009/October/11 02:48 Hi! 7263 T_CN_URL hits in 15517 spam corpus 7200 T_CN_8_URL hits in 15517 spam corpus Does this make any sense? This is funny. Could someone add this rule to the sandbox? I'm just curious. I have to admire one thing about

Re: .cn Oddity

2009-10-11 Thread Raymond Dijkxhoorn
Hi! 7263 T_CN_URL hits in 15517 spam corpus 7200 T_CN_8_URL hits in 15517 spam corpus Does this make any sense? This is funny. Could someone add this rule to the sandbox? I'm just curious. I have to admire one thing about spammers. They respond very rapidly to "threats" to their ability

Re: .cn Oddity

2009-10-10 Thread Warren Togami
On 10/11/2009 02:07 AM, jdow wrote: I have to admire one thing about spammers. They respond very rapidly to "threats" to their ability to break through spam protection software. You became curious and mentioned this on the date above. Spammers are already using <7 character names>.cn. {^_-} Y

Re: .cn Oddity

2009-10-10 Thread jdow
From: "Warren Togami" Sent: Wednesday, 2009/September/30 21:40 uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i describe T_CN_URL Contains a URL in the .cn domain uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8 characters long h

Re: .cn Oddity

2009-10-04 Thread John Hardin
On Sun, 4 Oct 2009, Warren Togami wrote: On 10/04/2009 04:07 PM, John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: > The "Oddity" I was pointing out at the beginning of the thread is not > prevalence of .cn URI's, but rather most of them appear to be exactly > 8 characters long.

Re: .cn Oddity

2009-10-04 Thread Warren Togami
On 10/04/2009 04:07 PM, John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: The "Oddity" I was pointing out at the beginning of the thread is not prevalence of .cn URI's, but rather most of them appear to be exactly 8 characters long. Are there any other .cn domain formats (like {8}.c

Re: .cn Oddity

2009-10-04 Thread John Hardin
On Thu, 1 Oct 2009, Warren Togami wrote: The "Oddity" I was pointing out at the beginning of the thread is not prevalence of .cn URI's, but rather most of them appear to be exactly 8 characters long. Are there any other .cn domain formats (like {8}.com.cn) that would be of interest? I was tr

Re: .cn Oddity

2009-10-04 Thread John Hardin
On Sun, 4 Oct 2009, Karsten Br?ckelmann wrote: On Sun, 2009-10-04 at 09:59 -0400, Warren Togami wrote: On 10/04/2009 12:21 AM, John Hardin wrote: Right, in adding things to the sandbox it does not necessarily mean I suggest they should become rules. I am mainly curious to see what the result

Re: .cn Oddity

2009-10-04 Thread Karsten Bräckelmann
On Sun, 2009-10-04 at 09:59 -0400, Warren Togami wrote: > On 10/04/2009 12:21 AM, John Hardin wrote: > > > Right, in adding things to the sandbox it does not necessarily mean I > > > suggest they should become rules. I am mainly curious to see what the > > > results say. > > > > Warning: autopromo

Re: [SA] .cn Oddity

2009-10-04 Thread Warren Togami
On 10/04/2009 12:21 AM, John Hardin wrote: On Sat, 3 Oct 2009, Warren Togami wrote: On 10/03/2009 07:50 PM, Adam Katz wrote: 8 is *extremely* important in Chinese culture. When running these tests, make sure that there is a good quantity of .cn TLD URIs in the ham before drawing any conclusio

Re: .cn Oddity

2009-10-03 Thread John Hardin
On Sat, 3 Oct 2009, Warren Togami wrote: On 10/03/2009 07:11 PM, John Hardin wrote: > [^./]{8}\.cn > > Actually, doesn't this match other characters that shouldn't be in a > domain name? ...is _anything_ (apart from periods) excluded from domain names these days? :) Changed to \w{8} f

Re: [SA] .cn Oddity

2009-10-03 Thread John Hardin
On Sat, 3 Oct 2009, Warren Togami wrote: On 10/03/2009 07:50 PM, Adam Katz wrote: 8 is *extremely* important in Chinese culture. When running these tests, make sure that there is a good quantity of .cn TLD URIs in the ham before drawing any conclusions. Right, in adding things to the san

Re: .cn Oddity

2009-10-03 Thread Warren Togami
On 10/03/2009 07:11 PM, John Hardin wrote: [^./]{8}\.cn Actually, doesn't this match other characters that shouldn't be in a domain name? ...is _anything_ (apart from periods) excluded from domain names these days? :) Changed to \w{8} for testing. Can you provide examples of needing more than

Re: [SA] .cn Oddity

2009-10-03 Thread Warren Togami
On 10/03/2009 07:50 PM, Adam Katz wrote: 8 is *extremely* important in Chinese culture. When running these tests, make sure that there is a good quantity of .cn TLD URIs in the ham before drawing any conclusions. Right, in adding things to the sandbox it does not necessarily mean I suggest t

Re: [SA] .cn Oddity

2009-10-03 Thread Adam Katz
Warren Togami wrote: >>> The "Oddity" I was pointing out at the beginning of the thread is not >>> prevalence of .cn URI's, but rather most of them appear to be exactly 8 >>> characters long. Could someone please commit my T_CN_8_URL rule to the >>> sandbox so we can see if that trend holds beyond

Re: .cn Oddity

2009-10-03 Thread John Hardin
On Sat, 3 Oct 2009, Warren Togami wrote: Can't trust those results yet. The trailing slash bug, and John Rudd might be correct about whitespace? I doubt whitespace will be a problem. That would break the parser before it even got to the rule, and while "dom%20name.cn" might be syntactically

Re: .cn Oddity

2009-10-03 Thread John Rudd
On Sat, Oct 3, 2009 at 15:55, John Hardin wrote: > On Sat, 3 Oct 2009, John Rudd wrote: > >> On Sat, Oct 3, 2009 at 11:06, Warren Togami wrote: >> >>> >>> # 8-letter .cn domain, per Warren Togami >>> uri            CN_EIGHT >>>  m;^https?://(?:[^./]+\.)*[^./]{8}\.cn/; >>> describe       CN_EIGHT

Re: .cn Oddity

2009-10-03 Thread John Hardin
On Sat, 3 Oct 2009, John Rudd wrote: On Sat, Oct 3, 2009 at 11:06, Warren Togami wrote: # 8-letter .cn domain, per Warren Togami uri            CN_EIGHT            m;^https?://(?:[^./]+\.)*[^./]{8}\.cn/; describe       CN_EIGHT            .CN uri with eight-letter domain name score          

Re: .cn Oddity

2009-10-03 Thread Warren Togami
On 10/03/2009 05:08 PM, John Hardin wrote: On Sat, 3 Oct 2009, Warren Togami wrote: On 10/01/2009 02:36 PM, John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: > The "Oddity" I was pointing out at the beginning of the thread is not > prevalence of .cn URI's, but rather most of them ap

Re: .cn Oddity

2009-10-03 Thread John Rudd
On Sat, Oct 3, 2009 at 11:06, Warren Togami wrote: > > # 8-letter .cn domain, per Warren Togami > uri            CN_EIGHT            m;^https?://(?:[^./]+\.)*[^./]{8}\.cn/; > describe       CN_EIGHT            .CN uri with eight-letter domain name > score          CN_EIGHT            0.10 > > Pos

Re: .cn Oddity

2009-10-03 Thread John Hardin
On Sat, 3 Oct 2009, Warren Togami wrote: On 10/01/2009 02:36 PM, John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: > The "Oddity" I was pointing out at the beginning of the thread is not > prevalence of .cn URI's, but rather most of them appear to be exactly > 8 characters long.

Re: .cn Oddity

2009-10-03 Thread John Hardin
On Sat, 3 Oct 2009, Ned Slider wrote: Warren Togami wrote: On 10/01/2009 02:36 PM, John Hardin wrote: > On Thu, 1 Oct 2009, Warren Togami wrote: > > > The "Oddity" I was pointing out at the beginning of the thread is > > not prevalence of .cn URI's, but rather most of them appear to be >

Re: .cn Oddity

2009-10-03 Thread Ned Slider
Warren Togami wrote: On 10/01/2009 02:36 PM, John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: The "Oddity" I was pointing out at the beginning of the thread is not prevalence of .cn URI's, but rather most of them appear to be exactly 8 characters long. Could someone please commit my

Re: .cn Oddity

2009-10-03 Thread Warren Togami
On 10/01/2009 02:36 PM, John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: The "Oddity" I was pointing out at the beginning of the thread is not prevalence of .cn URI's, but rather most of them appear to be exactly 8 characters long. Could someone please commit my T_CN_8_URL rule to th

Re: .cn Oddity

2009-10-02 Thread MySQL Student
Hi All, Regarding the .cn oddity, I added these to my rules, and of about 79k messages today so far, I have the following: uri LOC_URI_CN m;^https?://[^/?]+\.cn\b; uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i LOC_URI_CN: 2926 T_CN_8_URL: 1634 HTH, Alex

Re: .cn Oddity

2009-10-01 Thread John Hardin
On Thu, 1 Oct 2009, Warren Togami wrote: The "Oddity" I was pointing out at the beginning of the thread is not prevalence of .cn URI's, but rather most of them appear to be exactly 8 characters long. Could someone please commit my T_CN_8_URL rule to the sandbox so we can see if that trend hol

Re: .cn Oddity

2009-10-01 Thread jdow
From: "Ned Slider" Sent: Thursday, 2009/October/01 10:48 Warren Togami wrote: On 10/01/2009 01:05 PM, John Hardin wrote: On Thu, 1 Oct 2009, jdow wrote: From: "John Hardin" Yours may still hit .cn in the path part. May I suggest: m;^https?://[^/?]+\.cn\b; Regardless of their correctn

Re: .cn Oddity

2009-10-01 Thread jdow
From: "Warren Togami" Sent: Thursday, 2009/October/01 10:24 On 10/01/2009 01:16 PM, Warren Togami wrote: On 10/01/2009 01:05 PM, John Hardin wrote: On Thu, 1 Oct 2009, jdow wrote: From: "John Hardin" Yours may still hit .cn in the path part. May I suggest: m;^https?://[^/?]+\.cn\b; R

Re: .cn Oddity

2009-10-01 Thread Ned Slider
Warren Togami wrote: On 10/01/2009 01:05 PM, John Hardin wrote: On Thu, 1 Oct 2009, jdow wrote: From: "John Hardin" Yours may still hit .cn in the path part. May I suggest: m;^https?://[^/?]+\.cn\b; Regardless of their correctness, would you care to expound on the success of these two

Re: .cn Oddity

2009-10-01 Thread Warren Togami
On 10/01/2009 01:16 PM, Warren Togami wrote: On 10/01/2009 01:05 PM, John Hardin wrote: On Thu, 1 Oct 2009, jdow wrote: From: "John Hardin" Yours may still hit .cn in the path part. May I suggest: m;^https?://[^/?]+\.cn\b; Regardless of their correctness, would you care to expound on the

Re: .cn Oddity

2009-10-01 Thread Warren Togami
On 10/01/2009 01:05 PM, John Hardin wrote: On Thu, 1 Oct 2009, jdow wrote: From: "John Hardin" Yours may still hit .cn in the path part. May I suggest: m;^https?://[^/?]+\.cn\b; Regardless of their correctness, would you care to expound on the success of these two rules, John? I like what

Re: .cn Oddity

2009-10-01 Thread John Hardin
On Thu, 1 Oct 2009, jdow wrote: From: "John Hardin" Yours may still hit .cn in the path part. May I suggest: m;^https?://[^/?]+\.cn\b; Regardless of their correctness, would you care to expound on the success of these two rules, John? I like what works not political correctness. I

Re: .cn Oddity

2009-10-01 Thread John Hardin
On Thu, 1 Oct 2009, Benny Pedersen wrote: On tor 01 okt 2009 18:26:01 CEST, John Hardin wrote m;^https?://[^/?]+\.cn\b; replace ; with / no ? m/\bhttps?://[^/?]+\.cn\b/i No. The point to m; is so that you can embed / in the RE without escaping them. You are changing the RE delimiters. m

Re: .cn Oddity

2009-10-01 Thread jdow
From: "John Hardin" Sent: Thursday, 2009/October/01 09:26 On Thu, 1 Oct 2009, Ned Slider wrote: John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: > uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i > describe T_CN_URL Contains a URL in the .cn domain > > uri T_CN_8_URL /[\/.]+\

Re: .cn Oddity

2009-10-01 Thread Benny Pedersen
On tor 01 okt 2009 18:26:01 CEST, John Hardin wrote m;^https?://[^/?]+\.cn\b; replace ; with / no ? m/\bhttps?://[^/?]+\.cn\b/i -- xpoint

Re: .cn Oddity

2009-10-01 Thread John Hardin
On Thu, 1 Oct 2009, Ned Slider wrote: John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: > uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i > describe T_CN_URL Contains a URL in the .cn domain > > uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i > describe T_CN_8_URL Contains a URL i

Re: .cn Oddity

2009-10-01 Thread Ned Slider
John Hardin wrote: On Thu, 1 Oct 2009, Warren Togami wrote: uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i describe T_CN_URL Contains a URL in the .cn domain uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8 characters long http:

Re: .cn Oddity

2009-10-01 Thread John Hardin
On Thu, 1 Oct 2009, Warren Togami wrote: uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i describe T_CN_URL Contains a URL in the .cn domain uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8 characters long http://ruleqa.spamassassi

.cn Oddity

2009-09-30 Thread Warren Togami
uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i describe T_CN_URL Contains a URL in the .cn domain uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8 characters long http://ruleqa.spamassassin.org/20090930-r820211-n/T_CN_URL/detail La