RH8, sendmail 8.12.5, SA 2.43, MD 2.24, Razor 2.20 This morning an email arrived with the html code below and only rated a 2.7 (I commented out the webbug just in case). Its no surprise that it rated that low since there is very little text.
My current fix to prevent future messages coming through for this site is to add an entry in the local.cf: body JIZZTOPIA /jizztopia\.com/i describe JIZZTOPIA Contains 'www.jizztopia.com' score JIZZTOPIA 100 Not very scalable. I started to wonder if someone maintains a list of known porn sites. I discovered that squidguard (http://www.squidguard.org/blacklist/) has several different lists including porn. We don't use squid or squidguard but I installed it and looked at the porn domain and url lists. This particular site was not listed but several from other spam messages are. The files I have date back to Mar 19, 2002; there are more current files. The domains file has 100,000+ entries in it with about 55% being IP addresses and the rest actual domain names. Is there an active list of porn sites maintained somewhere? Can someone shed some light on what it would take to have SA search the list and assign a score if it finds matching entry in the body? Is this even feasible? Running squid and squidGuard is not an option as we have multiple locations and several staff members who work from home with their own Internet connections but centralized email. Thanks. Matthew Prentice X-Spam-Checked: This message probably not SPAM X-Spam-Flag: NO X-Spam-Level: ** (2.7) X-Spam-Tests: CTYPE_JUST_HTML,HTML_WITH_BGCOLOR,MAILTO_LINK,SPAM_PHRASE_05_08,WEB_BUGS X-Spam-Report: SPAM: 2.70 hits, 5 required; SPAM: * 1.6 -- BODY: Spam phrases score is 05 to 08 (medium) SPAM: [score: 5] SPAM: * 0.3 -- BODY: HTML mail with non-white background SPAM: * 0.2 -- BODY: Image tag with an ID code to identify you SPAM: * 0.2 -- BODY: Includes a URL link to send an email SPAM: * 0.4 -- HTML-only mail, with no text version <html><head><title>FREE MOVIE - FREE TOUR - Come and get your rocks off at www.jizztopia.com.</title> </head><body BGCOLOR=#cc3333 LEFTMARGIN=0 TOPMARGIN=0 MARGINWIDTH=0 MARGINHEIGHT=0> <center><a HREF="http://www.jizztopia.com/";><img SRC="http://jizztopia.com/msg/1/images/index.jpg"; WIDTH=500 HEIGHT=300 BORDER=0></a> </center> <PRE> If you are not interested in receiving this mail message, please forward this email to our organization at <A HREF="mailto:[EMAIL PROTECTED]";>[EMAIL PROTECTED]</A> We in no way wish to send any non-requested email to any persons, as the material advertised within this message may contravene local statutory regulations Automatic removal: <A HREF="http://newposts.net/no.php?u=1497350";>http://newposts.net/no.php?u=149 7350</A> </PRE><!--IMG HEIGHT="1" WIDTH="1" SRC="http://newposts.net/db.php?m=431&e=1497350"; --></BODY></HTML> ------------------------------------------------------- This sf.net email is sponsored by: Are you worried about your web server security? Click here for a FREE Thawte Apache SSL Guide and answer your Apache SSL security needs: http://www.gothawte.com/rd523.html _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
![http://jizztopia.com/msg/1/images/index.jpg"](http://jizztopia.com/msg/1/images/index.jpg"){kind=link}