ASN and SpamAssassin

Friday, December 15. 2006

I was reading up some interesting slides (PDF, 446KByte) by Joe Sauver humbly titled “Route Injection and Spam”. Despite it’s title, the slides are great at connecting all the dots one might have in his head regarding routing, ASNs, routing views and registries and all that stuff.

While I was reading the paper I wondered whether the ASN where a particular message (purportedly) came from would make a good token for spam filtering, either in a Bayes context or in a white-, grey- and blacklisting context.

So in order to dig a little bit deeper, I wrote an experimental SpamAssassin plugin which will add a header. It looks like X-Spam-ASN: 24940 213.239.192.0/18 where “24940” is the ASN the mail came from and “213.239.192.0/18” is the announced network.

You can download the ASN plugin at ~~http://matthias.leisi.net/uploads/ASN-Plugin.tar~~ — feedback is welcome.

Btw., you can also take a look at Init 7’s ASN extension for Webalizer.

Update Dec. 15, 2006, 20:45 CET: A slightly revised version of the plugin (including now being part of the Mail::SpamAssassin::Plugin package) can be found at the Apache/SpamAssassin issue tracker, bug 4770

Update Dec. 22, 2006, 20:50 CET: The version on bug 4770 has progressed substantially over the one available here; I have thus removed the local version.

Posted by Matthias Leisi in DNS, IT, Mail, Spam at 11:44 | Comments (2) | Trackback (1)

Trackbacks

Trackback specific URI for this entry

Where does your spam come from?
Ever wondered where your spam comes from? Some partial answer may be found within. We will also explain why over 98% of the Internet are a good place to be. I let the SpamAssassin plugin which I wrote in response to SpamAssassin Bug 4770 run for a coup

Weblog: Matthias Leisi
Tracked: Dec 31, 15:04

Comments

Display comments as (Linear | Threaded)

Hi Matthias —

would you be interested in putting that into the SA distribution, as an available-but-disabled-by-default plugin? I’ve been looking for one of these for a while:

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4770

#1 Justin Mason (Homepage) on 2006-12-15 14:34 (Reply)

Hi Justin,

Absolutely no problem, although I think it requires some debugging / testing and the method to get at the TXT record is… subject to improvement ;) More by mail.

#1.1 Matthias Leisi on 2006-12-15 15:11 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Textile-formatting allowed E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above:
	Remember Information? Subscribe to this entry