Johann Spies wrote:
>
> Thanks. To me it is special to get help from Zürich. I have a
> daughter and son staying there.
Hallo Johann,
I've just checked the directory, and there are exactly two people
named 'Spies' in Zurich. Bwt, Denmark had a Simon Spies, a travel-king
who was quite famous i
Hallo Per,
>
> I have three rules that would have helped you catch some of those
> (I didn't check all of your examples):
>
> # google group URL contains ..
> uri NN_GOOGLE_GROUP_DD m'www\.google\.com/.*\.\..*/group/'i
> describe NN_GOOGLE_GROUP_DD Link to a Google group contains '..'
> sc
Johann Spies wrote:
> On Tue, Feb 24, 2009 at 02:51:36PM +0100, Karsten Bräckelmann wrote:
>> More seriously, unless you provide raw samples [1], including the
>> rules hit on your system, there's probably not much else to say.
>>
>
> You can download them at ftp://g...@ftp.sun.ac.za/pespos.tar.
On Tue, Feb 24, 2009 at 02:51:36PM +0100, Karsten Bräckelmann wrote:
> More seriously, unless you provide raw samples [1], including the rules
> hit on your system, there's probably not much else to say.
>
You can download them at ftp://g...@ftp.sun.ac.za/pespos.tar.gz . Use
password 'tydelik'.
On Tue, February 24, 2009 17:02, Per Jessen wrote:
>> Probably a safer rule than my first post is the
>> following untested code that at least checks if the message came
>> from google.
> Jason, why do you think it's important where the msgs come from?
google domainkeys uses yahoo.com ?
i have n
Karsten Bräckelmann wrote:
> However, there are some highly abusive patterns sticking out. A google
> URI with a ../ in the path? Sure! Score 2. :) Alternating alpha and
> numbers might be worth another point. A question mark in a google groups
> URI? Punish that.
You can eliminate links to Usene
Karsten Bräckelmann wrote:
> On Tue, 2009-02-24 at 17:59 +0100, Per Jessen wrote:
>> Karsten Bräckelmann wrote:
>
>> Yeah, I guess I was in a hurry - but actually, they barely hit
>> anything,
>> only DKIM_SIGNED and DKIM_VERIFIED. I've added my own rule:
>>
>> uri PJ_GOOGLEGRP_DODGYURI m
On Tue, 2009-02-24 at 17:59 +0100, Per Jessen wrote:
> Karsten Bräckelmann wrote:
> Yeah, I guess I was in a hurry - but actually, they barely hit anything,
> only DKIM_SIGNED and DKIM_VERIFIED. I've added my own rule:
>
> uri PJ_GOOGLEGRP_DODGYURI m'www\.google\.com/.*\.\..*/group/'i
> w
Per Jessen wrote:
>> A question mark in a google
>> groups URI? Punish that.
>
> Good point, I hadn't spotted that one.
>
Actually I had, but my rule didn't take the superfluous garbage (in the
URL) before /group/ into account. Thanks for making me double check
it.
/Per Jessen, Zürich
Marc Perkel wrote:
> I think the idea is to look to see if the message came from google
> servers to avoid false positives. If it's not from a google server
> then it's more likely spam.
Ah, okay - got it. Yes, make sense.
/Per Jessen, Zürich
Karsten Bräckelmann wrote:
> On Tue, 2009-02-24 at 16:14 +0100, Per Jessen wrote:
>> Karsten Bräckelmann wrote:
>>
>> > Yes, I too get spam with google groups URIs. Typically scores quite
>> > high, though. So I guess the answer would be "I deal with it by
>> > running SA..." ;)
>> >
>> > More s
> -Original Message-
> From: Per Jessen [mailto:p...@computer.org]
> Sent: Tuesday, February 24, 2009 11:02 AM
> To: users@spamassassin.apache.org
> Subject: RE: Googlegroups related spam
>
> >
> > My experience is the same in that the messages don't ac
On Tue, 2009-02-24 at 16:14 +0100, Per Jessen wrote:
> Karsten Bräckelmann wrote:
>
> > Yes, I too get spam with google groups URIs. Typically scores quite
> > high, though. So I guess the answer would be "I deal with it by
> > running SA..." ;)
> >
> > More seriously, unless you provide raw samp
Per Jessen wrote:
Jason Bertoch wrote:
-Original Message-
From: Per Jessen [mailto:p...@computer.org]
Sent: Tuesday, February 24, 2009 10:15 AM
To: users@spamassassin.apache.org
Subject: Re: Googlegroups related spam
here's a couple of examples that made it through my f
Jason Bertoch wrote:
>> -Original Message-
>> From: Per Jessen [mailto:p...@computer.org]
>> Sent: Tuesday, February 24, 2009 10:15 AM
>> To: users@spamassassin.apache.org
>> Subject: Re: Googlegroups related spam
>>
>>
>> here'
> -Original Message-
> From: Per Jessen [mailto:p...@computer.org]
> Sent: Tuesday, February 24, 2009 10:15 AM
> To: users@spamassassin.apache.org
> Subject: Re: Googlegroups related spam
>
>
> here's a couple of examples that made it through my filter
Karsten Bräckelmann wrote:
> Yes, I too get spam with google groups URIs. Typically scores quite
> high, though. So I guess the answer would be "I deal with it by
> running SA..." ;)
>
> More seriously, unless you provide raw samples [1], including the
> rules hit on your system, there's probably
Jason Bertoch wrote:
-Original Message-
From: Johann Spies [mailto:jsp...@sun.ac.za]
Sent: Tuesday, February 24, 2009 7:59 AM
To: users@spamassassin.apache.org
Subject: Googlegroups related spam
The following link describes a problem we are experiencing:
http://www.joewein.net/blog/2009/
On Tue, 2009-02-24 at 14:58 +0200, Johann Spies wrote:
> The following link describes a problem we are experiencing:
> http://www.joewein.net/blog/2009/01/21/google-groups-spam-abuse-reporting-broken/
>
> It seems to me the only way to counter that type of spam is to
> do a curl or wget on each u
> -Original Message-
> From: Johann Spies [mailto:jsp...@sun.ac.za]
> Sent: Tuesday, February 24, 2009 7:59 AM
> To: users@spamassassin.apache.org
> Subject: Googlegroups related spam
>
> The following link describes a problem we are experiencing:
> http://www.joewein.net/blog/2009/01/21/g
20 matches
Mail list logo
