[Bug 7635] New: Bitcoin address check against reported scams

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

Bug ID: 7635
Summary: Bitcoin address check against reported scams
Product: Spamassassin
Version: unspecified
Hardware: All
OS: All
Status: NEW
Severity: enhancement
Priority: P2
Component: Plugins
Assignee: ***@spamassassin.apache.org
Reporter: ***@kjernsmo.net
Target Milestone: Undefined

With the rise of the scams using Bitcoin addresses, it seems to be an important
feature, but as it was argued in Bug #7468, Bitcoin is in wide use, so a simple
rule won't cut it.

However, there are sites where you can report scams, e.g.
https://bitcoinwhoswho.com/ and it has an API to query for scams. So, a plugin
that can discover bitcoin addresses and then query for scams could have
significant impact.

Kjetil

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

Henrik Krohns <***@hege.li> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@hege.li

--- Comment #3 from Henrik Krohns <***@hege.li> ---
Haven't had a chance to commit yet, but I've also enchanced HashBL to do
generic raw or hashed queries like

body HASHBL_BTC eval:check_hashbl_bodyre('btcbl.foo.bar',
'sha1/max=10/shuffle', '\b([13][a-km-zA-HJ-NP-Z1-9]{25,34})\b')

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

--- Comment #8 from Henrik Krohns <***@hege.li> ---
check_hashbl_bodyre can be used in trunk

Sending UPGRADE
Sending lib/Mail/SpamAssassin/Plugin/HashBL.pm
Transmitting file data ..done
Committing transaction...
Committed revision 1848553.

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

Benny Pedersen <***@junc.eu> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@junc.eu

--- Comment #4 from Benny Pedersen <***@junc.eu> ---
i would like to try btc whitelist on succes, its imho to risky to send btc and
see looses to late

possible to support whitelist ?

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

Kevin A. McGrail <***@apache.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@apache.org
Target Milestone|Undefined |4.0.0

--- Comment #5 from Kevin A. McGrail <***@apache.org> ---
I'd like to see the hashbl additions and consider that for 4.0 rather than yet
another plugin. I'm trying to work on 3.4.3 so this would be for 4.0 IMO.

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

--- Comment #2 from Giovanni Bechis <***@paclan.it> ---
https://btcblack.it for work in progress info.

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

Giovanni Bechis <***@paclan.it> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@paclan.it

--- Comment #1 from Giovanni Bechis <***@paclan.it> ---
I recently created a dns bitcoin blacklist with a SpamAssassin plugin for this
purpose.
SpamAssassin Plugin is just a bit more than a Poc and it doesn't catch
obfuscated bitcoin addresses but it is a starting point.

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

--- Comment #6 from Giovanni Bechis <***@paclan.it> ---
(In reply to Benny Pedersen from comment #4)

Post by b***@bugzilla.spamassassin.org
i would like to try btc whitelist on succes, its imho to risky to send btc
and see looses to late
possible to support whitelist ?

AFAIK there isn't any public bitcoin whitelist available
and, as for email addresses, public whitelists could be poisoned.

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7635

--- Comment #7 from Giovanni Bechis <***@paclan.it> ---
(In reply to Kevin A. McGrail from comment #5)

Post by b***@bugzilla.spamassassin.org
I'd like to see the hashbl additions and consider that for 4.0 rather than
yet another plugin. I'm trying to work on 3.4.3 so this would be for 4.0
IMO.

the plugin was just the quickest way to test my server
code, hashbl is definitely the way to go.