Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Download Lists
  FAQ FAQ  Forum Search   Register Register  Login Login

Download Lists

 Post Reply Post Reply
Author
Rob M View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Rob M Quote  Post ReplyReply Direct Link To This Post Topic: Download Lists
    Posted: 09 March 2004 at 10:50am

Anyone willing to post a compiled keyword/blacklist for LogSat users to download?

Does anyone know where to download a good one from?

Back to Top
eric View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote eric Quote  Post ReplyReply Direct Link To This Post Posted: 09 March 2004 at 4:11pm
mortgage
169.cc
homeloan
viagra
Rem0ve
free-porn
sexxx
enlargement
penis
online-casino
systemworks
to home owners
legal+problems
 sex life
prescripti0n
legally ordained
life insurance
list your website
bestspecials.
loan
lose weight in
lusty
de-scrambler
descrambler
copy any dvd movie
bargain
working at home
stop mailings here
printer cartridges
save up to
money-making
home improvement
premiumoffers
get cash
low rates
debt consolidation
refi's
cash-out
home equity
prescription drugs
lose weight
prices on the net
anymore offers click
click here to unsubscribe
special offers
look younger
reverses aging
reverse aging
member of the opt-in
copying dvd's
remove me
screensaver for
ewijk@
jmeulemans@
tburger@
fheinis@
mnugteren@
fheinis@
natacha@aquasense.com
f r e e
optout.
v1agra
n0w y0u can save
d r u g s
to remove your address from further
broadcast email
 jackpot
.pif.bat
 cock
.bat.pif
.scr
.exe
.pif
.doc.pif
 lesbian
girls love this
as a subscriber
screen saver
go here to be purged
 making money
.lnk.scr.
.lnk.pif.
.lnk.scr.
.lnk.pif.
.doc.scr.
windowsupdatenow.
free-gifts.mx
@oinlist.
all natural solution
100% guaranteed
act now!
fltn.
.eml.exe
amazingoffers
@oinlist
notice by request or may have recently become a
to abuse-msg_
as seen on tv
dealsnow
optinbargains
btamail
latinmail
client.attbi.com
dealsnow
amazingoffer
latesttrend
greatbiz
dontbleftout
bestspecial
printer supplies
printer cartridge toner
bargains4u.
 grant
size matters
remove yourself
prescription meds
stop mailings here
lastfreeday.com
bettervalues
greatbizservices
our free offer
this user doesn't have a yahoo
1nk.
your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif
subject: re: approved
see the attached file for details
more than 500.000 already infected!
patch.exe
use this internet explorer patch now!
windowsupdatenow.
.doc.exe
message.zip
.vbsit's near 911!
nice butt baby!
largerlover.
lose,pound,in
out of office autoreply: delivery failure
your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif
symantec_antivirus_for_smtp_gateways
wicked screensaver
re: thank you!
re: that movie
more than 500.000 already infected!
use this patch immediately !
patch.exe
use this internet explorer patch now!
scr.scr
pif.scr
scr.pif
.doc.exe
message.zip
it's near 911!
wicked screensaver
your application
re: my details
>no more please<
current net upgrade
run attached file. choose yes on displayed dialog
current net upgrade
newest internet upgrade
q*.exe
update*.exe
run attached file. choose yes on displayed dialog
current net upgrade
newest internet upgrade
run attached file.
choose yes on displayed dialog
.vprx
>no thank you<br>i want to unsuscribe
still cant find it?
the,porno,extravaganza
network receiver
failure announcement
newest internet upgrade
subject: bug advice
subject: returned message returned to sender
subject: failure letter
subject: undeliverable mail returned to sender
ms net email delivery service
.gif.exe
valium,xanax
great-net-offers
returned message: returned to mailer
i'm sorry to have to inform you that the message returned below could not be delivered to the following addresses:
inet email storage system
check our list and mail your requests!
this is the last cumulative update.
cracks!
this is the pack
send reply if you want to be official beta tester.
i'm going crazy... please try to find the bug!
test it 30 days for free.
adult content!!! use with parental advisory.
test this rom! it rocks!.
send me your comments...
pr0n!
use this patch immediately !
dear friend , use this internet explorer patch now!
undelivered mail: returned to mailer
subject: abort message
subject: returned message
subject: undelivered message user unknown
subject: undeliverable message: user unknown
subject: returned message: returned to sender
>rem<!--,-->ove
 viagra,
re: 0!~
>remove mail<
mailerrobot@*
@homeserver.
@microsoft.net
*businessbooster*@*
rmailprogram@
mailerservice@
mailprogram@yahoo.
enjoy!
this is all i can send
you gonna love it
here is what u wanted
looool
save it for hard times
you have to see this!
emazing!
/default.asp?id=omni"><!
even when u're without ur bh
/default.asp?id=omni1"><!
be careful! new mail worm
lmailform@
mailengine@
subject: re[2]: our private photos
subject: don't be late!
.dialup.stlsmo.swbell.net
dyn.optonline.net
 odin :null
aslanina@:null
.herbal:null
herbal.:null
rescription drug
.us/out.htm
Online Pharmac
As I've promised I'm sending you my photo. Use old password
-van.wijk.net?bart@
.biz/nomore.htm
CREDIT CARD DEBT
herbal.biz/
.ineed
 Cialis
med.com"
 eBay!
.biz/
.us/
p,r,escriptions
L0SE WE1GHT
CL1CK H
debt.com"
I have been thinking about you all night.
meds.com"
Soma
Phentermine
mst.dk
/http://www.like
@http://www.auction
emailbroadcast.
>No Mor
@herbal
CreateObject("WScript
CreateObject("JScript
>$RANDOMIZE
L0SE<
Hi Greg its Wendy
pack of child porn
Cold Outside She Gives Me Warm Inside
You will love this cute picture
Enjoy this great picture.
Donīt miss this cool picture
Dear customer, We are enclosing Fix
This is the most wicked screen saver
This is a new crack for porn site
I think the last mail you sent me was infected with W32.Blaster
AFf/CgYB
@ase.
Easy Way to revel ur love !
Screensaver to ur friends
.proxad.
nmore.html"
Test =)
Here is my photo, that you asked for yesterday:null
Mail transaction failed. Partial message is available:null
The message contains Unicode characters and has been sent as a binary attachment:null
Bart, ENLAR
info33.info
you can now visit more than 1200 very very hot web pages
will close/filter my email/site accounts
RE TO FI<
=?ISO-8859-1?B?aGk=?=
Subject line: Microsoft Alert: Please Read!
New MyDoom Virus Variant Detected!
^_^ meay-
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 10 March 2004 at 8:45am

Rob,

I really find that "Literal" keywords have limited value and I try to look for the method used to hide real words or "obfuscation".  As a result, my keyword list is very short and yet very effective.  Using Regular Expressions is the ticket and literals should only be required where all else has failed.  A good example ... I want to block obscured variations of the standard drugs we all see advertised.  However, I still want to be able to use the word viagra in a normal message.  For that matter, if the word viagra is used in a message and is not in any way hidden, altered or otherwise mucked with, then the message, by definition, may not be Spam.  Yes, it may be an annoying add but if nothing is used to hide ant of the text, then the advertiser may actually have followed the anti-Spam rules and blocking it at that point is not called Spam blocking, it called censoring.  As an ISP, we can not be in the business of censorship.  I can, however, "censor" the content that gets to my kids computers and I do that ... but at a local level.

Anyway, back to the example, the following expression could be used to detect the obscured versions of drug spelling without blocking the actual words in a plain text message:

((?i)(Subject:[^\n]*((all drugs here)|(\|v\|)|(ri\.c3)|(x\_a\_na)|(va\:l)|(v\@1)|(v1\@)|(x\@n)|(fi0r)|(s\:oma)|(ing 4 U)).*\r\n))

This is an example only and is used for the Subject line only but you should get the idea. Notice that I did youe one "Plain Text" keyword in the expression but again, it is limited to the subject line only.

Regards,

Dan S.

 
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.148 seconds.