spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Brian Wilson <wilson...@bubba.org>
Subject Re: debbie-dealz / frosty-saver / got-hyrda / aero-dog spam
Date Wed, 12 Sep 2007 17:20:53 GMT
On Wed, 12 Sep 2007, Brian Wilson wrote:

>
> I've somehow made it onto spam list that isn't being picked up by RBLs or by 
> bayes.  All messages have a url that looks like this (where X's are all 
> digits):
>
> http://aero-dog.com/1-23-28276-45381XXXXXXX.html
>
> All messages are originating from 206.131.x.x and I have been submitting them 
> to spamcop.  A sample message is here: http://bubba.org/spam/newspam1.txt
>
> Any suggestions for detecting this?  My bayes has been pretty much spot on 
> for months, so this has me puzzled.
>

The sample was older so that is probably why it is being picked up, but 
the newer samples from here are not getting scored from RBL's.  I 
added this URI rule to pick these up:

uri FROSTY_SAVER_URI /^http\:\/\/[\S\-]+\/[\d\-]+.html/ score 
FROSTY_SAVER_URI 10

I'm sure someone will complain that they have a better regex, but it's 
working for me.

Brian

Mime
View raw message