Hi, dailypromotions and our HiSpeed friends (hispeed, h-s-m, hispeed-media, etc) are all in my qmail badmailfrom.
If anyone would like it, feel free to drop me a line. Most of them are also in rbl.axess.com along with most dsl.x.x.x.x.br address's. (http://rbllist.axess.com) Rick ----- Original Message ----- From: "Michael Moncur" <[EMAIL PROTECTED]> To: "Paul" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Thursday, December 05, 2002 5:58 PM Subject: RE: [SAtalk] 2.43 - too many false negatives > I just installed SA 2.43 and I am dismayed to find that it lets through > about 25% of the spam I receive -- this with my threshold set to 4.0. Are many of them from "DailyPromotions" or "HiSpeedMedia"? These are a couple of big spammers that are focusing on very clean messages with almost nothing but an image, and are undetected by the default SA rules. I have some specific rules aimed at them that seem to help. They change their URLS regularly, but some things stay the same: uri MGM_DAILY_CGI /cgi-bin\/dvs.cgi\?email/ describe MGM_DAILY_CGI mgm: DailyPromotions CGI link score MGM_DAILY_CGI 3.0 uri MGM_DAILY_PL /\/logic\/od.pl\?j/ describe MGM_DAILY_PL mgm: DailyPromotions redirect link score MGM_DAILY_PL 3.0 header MGM_DAILY_M X-Mailer-Version =~ /v 15098411/ describe MGM_DAILY_M mgm: frequent spam header score MGM_DAILY_M 3.0 body MGM_DISC /To discontinue the receipt of emails/i describe MGM_DISC mgm: Discontinue receipt of emails score MGM_DISC 2.5 -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "It is impossible to defeat an ignorant man in argument." --William G. McAdoo ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
