Some suggestions on behalf of SpamAssassin users

Hi there.

There's been quite a bit of discussion about Habeas on the SA list of 
late due to the recent rash of spammers utilizing the Habeas SWE to 
cut through content filters.

A lot of people are growing impatient and setting their HABEAS_SWE 
scores to zero, and some misguided folk are actually assigning it a 
positive score based on the belief that they receive no legitimate 
mail with the Habeas SWE!  While I understand the legal process can 
take a while (grinding slow but exceedingly fine, etc.) it might be 
nice for you guys to provide a status update on your website (or even 
a post to the SA list!) a little more often so people at least 
understand that the process is ongoing.

In the interim, though, I'd like to make a more technical suggestion. 
Since the Pharmacourt infringers have been using hijacked open relays 
(perhaps infected with some MyDoom or Beagle variant?) merely putting 
IP addresses into the HIL is something of an excercise in closing the 
barn door after the horse has gone (though certainly not a waste of 
time, since there are other horses).

It's been my observation that the URLs referenced in the Pharmacourt 
spam are far less variable than the relays they use (makes sense--
domains do have to be registered and that costs money), and that 
lends itself to the creation of a custom SpamAssassin ruleset which 
is demonstrably quite effective.  Working on the suggestions of SA 
list participants, I've been building the following based on URLs 
referenced within infringing e-mails I've received:

uri         PHARMACOURT_BIZ /\b(?:affiliatedrugs|affiliateddgrugs| \
              charterdrugs|fifthdimensionrx|firstassist| \
              majesticdrugs|moderndrugstore|pharmacourt| \
              pharmawarehouse|valuepointmeds)\.biz\b/i
describe    PHARMACOURT_BIZ Includes a link to spammer www.pharmacourt.biz
score       PHARMACOURT_BIZ 3.0

meta        HABEAS_VIOLATOR_LOCAL   (!HABEAS_VIOLATOR && HABEAS_SWE && \
              PHARMACOURT_BIZ)
describe    HABEAS_VIOLATOR_LOCAL   Spammer known to abuse Habeas mark
score       HABEAS_VIOLATOR_LOCAL   16.0

Over the past few weeks, these local rules have been catching 
infringing e-mails about twice as often as HABEAS_VIOLATOR (which is 
triggered by an infringer on the HIL) and very few infringing 
messages have made it to my Inbox.

So here's what I propose:  Habeas should create (or contribute to) a 
custom SpamAssassin ruleset! (see  
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm for 
examples of other rulesets in common usage.)

Since Habeas receives lots of reports of infringing mail, you could 
pull out URLs used by the infringers and generate a more 
comprehensive ruleset along the lines of what I've outlined above.

By updating such a ruleset as new URLs are discovered and making it 
available for download, SA users can be better protected from 
infringing spam while still retaining the benefit of properly scoring 
legitimate Habeas SWE users.  Additionally, by posting notices of 
updates to the SA discussion list, Habeas would be seen to be 
actively participating in the community which can't help but incur 
goodwill for the company.  I wouldn't be surprised if more people 
were encouranged to report their infringing mail, too, if they 
perceive a direct benefit to themselves by doing so.

So there you have it.  Food for thought, anyway!

----
Nels Lindquist <*>
Information Systems Manager
Morningstar Air Express Inc.