------=_Part_77579_21954680.1183480337934
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Funny you should mention that. I recently wrote a proof of concept plugin
that does exactly what you're talking about. The point was to check URLs
against google's safebrowsing list, which was just announced.

Unfortunately, the results were rather poor. The only hits that I got were
on messages that already scored 10+ points. And a few false positives --
last I checked, the main page for myspace was listed in the malware list (I
believe).

If anyone's interested, the (very rough) code for syncing google's lists,
and for checking a database containing the hashes is available.

Austin.

On 7/3/07, Matt wrote:
>
> Why can't Spamassassin do like a MD5 hash of any URL's in a message
> and check them against a database? I just think it would help catch
> things like: geocities.com/spamer123/ or spamer123.tripod.com and etc.
> It would also work for Tinyurl links and the like.
>
> Matt
>


------=_Part_77579_21954680.1183480337934
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Funny you should mention that.  I recently wrote a proof of concept
plugin that does exactly what you're talking about.  The point was to
check URLs against google's safebrowsing list, which was just announced.



Unfortunately, the results were rather poor.  The only hits that I got
were on messages that already scored 10+ points.  And a few false
positives -- last I checked, the main page for myspace was listed in the malware list (I believe).

If anyone's interested, the (very rough) code for syncing google's lists, and for checking a database containing the hashes is available.


Austin.

On 7/3/07, Matt <lm7812@gmail.com> wrote:

Why can't Spamassassin do like a MD5 hash of any URL's in a message
and check them against a database?  I just think it would help catch
things like: geocities.com/spamer123/
or spamer123.tripod.com and etc.
It would also work for Tinyurl links and the like.

Matt



------=_Part_77579_21954680.1183480337934--