Re: Using sender e-mail address or message content data in WHOIS search

2008-11-07 Thread John Hardin
On Fri, 7 Nov 2008, FractalBob wrote: Thanks, Mouss, for the pointers, but I still don't understand where the addresses and phone numbers in 70_sare_evilnum come from. Can SpamAssassin be configured to scan a message, pick up a domain and then do a WHOIS search, or did someone go through a few e

Re: Using sender e-mail address or message content data in WHOIS search

2008-11-07 Thread FractalBob
Thanks, Mouss, for the pointers, but I still don't understand where the addresses and phone numbers in 70_sare_evilnum come from. Can SpamAssassin be configured to scan a message, pick up a domain and then do a WHOIS search, or did someone go through a few e-mails by hand, query WHOIS using the do

Re: Using sender e-mail address or message content data in WHOIS search

2008-11-07 Thread mouss
FractalBob wrote: Sure, they do spoof, but one could write a script that pokes around the message content, looking for a URL or signature and use that instead. I found some rulesets, 70_sare_evilnum*.cf, that seem to do what I want, but I don't know how to use them; documentation is scarce for S

Re: Using sender e-mail address or message content data in WHOIS search

2008-11-07 Thread FractalBob
Sure, they do spoof, but one could write a script that pokes around the message content, looking for a URL or signature and use that instead. I found some rulesets, 70_sare_evilnum*.cf, that seem to do what I want, but I don't know how to use them; documentation is scarce for SpamAssassin. Does a

Re: Using sender e-mail address or message content data in WHOIS search

2008-11-07 Thread Benny Pedersen
On Fri, November 7, 2008 09:43, mouss wrote: > - since spammers often forge the sender address, you don't really care > of the corresponding whois infos. whois 127.0.0.1 let them forge it :) -- Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Using sender e-mail address or message content data in WHOIS search

2008-11-07 Thread Matus UHLAR - fantomas
> FractalBob wrote: > >Can SpamAssassin be configured to use the domain in the sender e-mail > >address > >or in the message content itself as an input parameter to, say, a WHOIS > >search, in order to locate either the sender or his ISP? I know this would > >be expensive, since it would require g

Re: Using sender e-mail address or message content data in WHOIS search

2008-11-07 Thread mouss
FractalBob wrote: Can SpamAssassin be configured to use the domain in the sender e-mail address or in the message content itself as an input parameter to, say, a WHOIS search, in order to locate either the sender or his ISP? I know this would be expensive, since it would require going out to the