On Wed, 10 Dec 2003 11:38:59 -0500, Stephen M. Przepiora <[EMAIL PROTECTED]> posted to spamassassin-talk: > Almost all spam comes through with a url to click on, or a url to load > an image from. Most spammers have multiple domains they use, and > rotate through them. We match these domains and add a 2 to the score. > I can not stress enough how effective this is. It cuts down the spam > down from 100-200 a day to 2-3 a day per user (obviously some users do > not get quite as much).
Why don't you put these in your own little DNSBL and figure out how to maintain that instead? It would also make it easier to share with us others -- what you have sounds like a useful resource. There used to be a DNSBL called something like "conduits of spam" which would blacklist domains who hosted click-throughs, but it never caught on. Maybe now the time is ripe. Then you'd only need a single rule, although probably you'd have to construct your own eval:() stuff for extracting URIs and querying the DNSBL with a suitably normalized URI (remember DNSBLs are basically operating on domain names so you would need to squeeze URIs into what DNS can handle). 16,000 SpamAssassin rules doesn't sound very manageable in any event so perhaps you should at least think about other ways to handle this. /* era */ -- The email address era the contact information Just for kicks, imagine at iki dot fi is heavily link on my home page at what it's like to get spam filtered. If you <http://www.iki.fi/era/> 500 pieces of spam for want to reach me, see instead. each wanted message. ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
