spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Brian Wilson <>
Subject Re: debbie-dealz / frosty-saver / got-hyrda / aero-dog spam
Date Wed, 12 Sep 2007 17:20:53 GMT
On Wed, 12 Sep 2007, Brian Wilson wrote:

> I've somehow made it onto spam list that isn't being picked up by RBLs or by 
> bayes.  All messages have a url that looks like this (where X's are all 
> digits):
> All messages are originating from 206.131.x.x and I have been submitting them 
> to spamcop.  A sample message is here:
> Any suggestions for detecting this?  My bayes has been pretty much spot on 
> for months, so this has me puzzled.

The sample was older so that is probably why it is being picked up, but 
the newer samples from here are not getting scored from RBL's.  I 
added this URI rule to pick these up:

uri FROSTY_SAVER_URI /^http\:\/\/[\S\-]+\/[\d\-]+.html/ score 

I'm sure someone will complain that they have a better regex, but it's 
working for me.


View raw message