Perhaps someone has already tried this, but it occurs to me that a sort of RBL for spammer phone numbers, e-mail addresses, and URLs would be useful.
Almost all spam includes a phone number, an e-mail address, or an URL for the victim to use to contact the spammer. Of course, many of these are throwaway contact info, intended to be used only for a few days, so SpamAssassin can't really have rules that check for them, except in a generic sense (like looking for 800 numbers and scoring them, but it's not a very definitive check). I have a list of phone numbers/addresses/URLs that I block at my mail server (using Postfix's content filter), but it's obviously hit and miss, because it requires that I receive spam with it first. It would be much more useful if SpamAssassin could locate each piece of contact information in the message and do a lookup on them if there were a service that tracked them, in the same way that it looks up IP addresses in the RBLs. The problem, of course, would be how to populate the database with "bad" information. Obviously, it could be done manually, but that's a pain. Perhaps SpamAssassin could report it when people use the -r option, although that has the usual problems of potential poisoning -- also, of course, some spam includes the recipient's address, and I can't quite see how to make sure that such addresses wouldn't get added to the database. Another possibility would be a system that could automatically parse other streams of spam reports to suck out the contact info. For example, one possibility that occurs to me is to have a machine parsing new postings to news.admin.net-abuse.sightings, although again, it might be difficult to figure out what's part of the spam and what's not -- the format there is almost, but not quite, standardized. In general, has this idea (tracking transient contact information from spam content, then making it available for others in an automated fashion) been tried, that anyone knows of? ------------------------------------ Robert L Mathews, Tiger Technologies ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Oh, it's good to be a geek. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
