spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Rupert Gallagher <r...@protonmail.com>
Subject Re: ramsonware URI list
Date Sun, 16 Jul 2017 17:52:20 GMT
It is a list of obsolete uris.
Sent from ProtonMail Mobile

On Fri, Oct 14, 2016 at 10:30 AM, Nicola Piazzi <Nicola.Piazzi@gruppocomet.it> wrote:

> ABUSE.CH mantains an updated lists of ramsonware lists, here the txt file link :
>
> https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt
>
> It is very simple to make a shell script that check file changes every hour, download
if there is a new one, and write a rule .cf using data contained in the file.
>
> But hor to write a rule ?
>
> We have more than 4000 URI in the file, we can do a single rule like this separating
URIs with | :
>
> uri URIRAMS /http://1natureresort.com/afdIJGY8766gyu|http://1jamprofit.com/hjy93JNBasdas/
>
> describe URIRAMS Match a Ramsonware URI
>
> score URIRAMS 5.00
>
> or is better to separe each URI :
>
> uri __URIRAMS00001 /http://1natureresort.com/afdIJGY8766gyu/
>
> uri __URIRAMS00002 /http://1jamprofit.com/hjy93JNBasdas/
>
> meta URIRAMS (__URIRAMS00001 | __URIRAMS00002)
>
> describe URIRAMS Match a Ramsonware URI
>
> score URIRAMS 5.00
>
> Obviously this example is related to 2 entries, and we have 4000 entries here …..
>
> Any suggestion ?
>
> Nicola PiazziCED - Sistemi
> COMET s.p.a.Via Michelino, 105 - 40127 Bologna – Italia
> Tel. +39 051.6079.293Cell. +39 328.21.73.470
> Web: [www.gruppocomet.it](http://www.gruppocomet.it/) [Descrizione: gc]
Mime
View raw message