Thanks, Mouss, for the pointers, but I still don't understand where the addresses and phone numbers in 70_sare_evilnum come from. Can SpamAssassin be configured to scan a message, pick up a domain and then do a WHOIS search, or did someone go through a few e-mails by hand, query WHOIS using the domain names found and add the phone #/address info to 70_sare_evilnum? I kind of doubt the second possibility, but had to ask ;-)
mouss-2 wrote: > > FractalBob wrote: >> Sure, they do spoof, but one could write a script that pokes around the >> message content, looking for a URL or signature and use that instead. >> >> I found some rulesets, 70_sare_evilnum*.cf, that seem to do what I want, >> but >> I don't know how to use them; documentation is scarce for SpamAssassin. >> Does >> anyone know what these files are and how to use them? >> > > these are SARE rules > > Visit > http://www.rulesemporium.com/rules.htm > and chose which rules you want to use. > > Then use sa-update to download them (periodically): > > http://wiki.apache.org/spamassassin/RuleUpdates > http://daryl.dostech.ca/sa-update/sare/sare-sa-update-howto.txt > > for more docs, check > http://wiki.apache.org/spamassassin/FrontPage > and > http://spamassassin.apache.org/doc.html > > > > -- View this message in context: http://www.nabble.com/Using-sender-e-mail-address-or-message-content-data-in-WHOIS-search-tp20375286p20387122.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
