Re: blogspot spam

2008-03-21 Thread Arvid Ephraim Picciani
On Friday 21 March 2008 04:27:05 Loren Wilton wrote: > body SOFTWARE_AD > /(?:|\bbezahlen.*runterladen|Windows\bund\bmit\bMacintosh|\bOriginalversion >en\b.*\blegal\b)/i > > You probably want to adjust this a little bit. There are a few things here > that make me think you aren't getting quite

Re: blogspot spam

2008-03-20 Thread Loren Wilton
body SOFTWARE_AD /(?:|\bbezahlen.*runterladen|Windows\bund\bmit\bMacintosh|\bOriginalversionen\b.*\blegal\b)/i You probably want to adjust this a little bit. There are a few things here that make me think you aren't getting quite what you expect. 1.Remove that first vertical bar. It

Re: blogspot spam

2008-03-20 Thread Arvid Ephraim Picciani
On Wednesday 19 March 2008 21:37:27 Loren Wilton wrote: > This is just off the top of my head, and needs linting and maybe tweaking > the scores. > > uriBAD_BLOGSPOTm'http://[a-z]+\d+\.blogspot\.com'i > scoreBAD_BLOGSPOT1 > > body__SOFTWARES/(?:product|software|softs|opportu

Re: blogspot spam

2008-03-20 Thread Benny Pedersen
On Wed, March 19, 2008 13:21, James E. Pratt wrote: > http://pastebin.com/m8520d64 > http://pastebin.com/m159c02de http://www.gossamer-threads.com/lists/spamassassin/users/90664 Botnet plugin hits them nicely Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

RE: blogspot spam

2008-03-19 Thread Michael Hutchinson
> -Original Message- > From: Arvid Ephraim Picciani [mailto:[EMAIL PROTECTED] > Sent: Thursday, 20 March 2008 9:04 a.m. > To: users@spamassassin.apache.org > Subject: Re: blogspot spam > > On Wednesday 19 March 2008 20:48:00 Michael Hutchinson wrote: > > For th

Re: blogspot spam

2008-03-19 Thread Loren Wilton
http://pastebin.com/m8520d64 http://pastebin.com/m159c02de This is just off the top of my head, and needs linting and maybe tweaking the scores. uriBAD_BLOGSPOTm'http://[a-z]+\d+\.blogspot\.com'i scoreBAD_BLOGSPOT1 body__SOFTWARES/(?:product|software|softs|opportuni

Re: blogspot spam

2008-03-19 Thread Arvid Ephraim Picciani
On Wednesday 19 March 2008 20:48:00 Michael Hutchinson wrote: > For those that don't run SA 3.2.3, you could test this rule: > uri CST_URI_BLOGSPOTm,http://\w+\.blogspot\.com\b, > describe CST_URI_BLOGSPOT blogspot.com throwaway URI > score CST_URI_BLOGSPOT 3.4 thanks Mi

RE: blogspot spam

2008-03-19 Thread Evan Platt
At 12:48 PM 3/19/2008, Michael Hutchinson wrote: For those that don't run SA 3.2.3, you could test this rule: uri CST_URI_BLOGSPOTm,http://\w+\.blogspot\.com\b, describe CST_URI_BLOGSPOT blogspot.com throwaway URI score CST_URI_BLOGSPOT 3.4 A few people disagree with

RE: blogspot spam

2008-03-19 Thread Michael Hutchinson
> -Original Message- > From: Yet Another Ninja [mailto:[EMAIL PROTECTED] > Sent: Thursday, 20 March 2008 1:48 a.m. > To: Arvid Ephraim Picciani > Cc: users@spamassassin.apache.org > Subject: Re: blogspot spam > > On 3/19/2008 1:24 PM, Arvid Ephraim Picciani wr

Re: blogspot spam

2008-03-19 Thread Yet Another Ninja
On 3/19/2008 1:24 PM, Arvid Ephraim Picciani wrote: On Wednesday 19 March 2008 13:21:20 James E. Pratt wrote: Hi. I'm seeing lots of these get by: http://pastebin.com/m8520d64 anyone have a rule for these? The last one I put up is at: http://pastebin.com/m159c02de Thanks, Jamie yeah exac

Re: blogspot spam

2008-03-19 Thread Arvid Ephraim Picciani
On Wednesday 19 March 2008 13:21:20 James E. Pratt wrote: > Hi. I'm seeing lots of these get by: > > http://pastebin.com/m8520d64 > > anyone have a rule for these? > > The last one I put up is at: > > http://pastebin.com/m159c02de > > Thanks, > > Jamie yeah exactly my issue. the site is in uribl a