PLEASE DO NOT REPLY UNLESS YOU CAN ANSWER THE QUESTION.

I have a working SpamAssassin rule which rejects messages based on URLs
within the body of the message.  This is used for spammers who forge From
addresses and are otherwise careful not to break rules.  I collect the
"click here to order" and "click here to unsubscribe" URLs from complaints.

The rule looks like this --

uri MY_BLACKLIST_URI
(18n-ready.com|123clk.com|beowolfhost.com|bestdealss.net|domainfactory.com|dv6.net|jackpotcity.com|largerlover.com|lovingtouches.org|mail-lists.net|yoursavingsweb.com)/i
describe MY_BLACKLIST_URI      Blacklisted URLs
score MY_BLACKLIST_URI 10

The question is --  How many domains can I add to this rule?  At what point
should I start another rule rather than make this one longer?
There must be some limit to how big a rule can be and some efficency limit
on how many strings can be linked by "|".




                                                                                       
                              
                      Tony Earnshaw                                                    
                              
                      <tonni                   To:      [EMAIL PROTECTED]              
        
                      @billy.demon.nl>         cc:                                     
                              
                      Sent by:                 Subject: Re: [SAtalk] URI rule -- how 
big?                            
                      spamassassin-tal                                                 
                              
                      k-admin                                                          
                              
                                                                                       
                              
                                                                                       
                              
                      06/25/2003 02:11                                                 
                              
                      AM                                                               
                              
                                                                                       
                              
                                                                                       
                              




Kai Schaetzl wrote:

>>You can probably do more efficient blocking at the MTA level...which one
>>are you using?
>
> No, he can't, this is a body test.

Postfix (my version is 2.0.12) can do body tests, but Postfix UCE rules
are "all or nothing" - one can't allocate points, as SA can. Therefore I
prefer to keep to SA. This means (Amavis) that I can't reject at smtp
data time - the value of this is a moot point, though.

Tony

--
Tony Earnshaw

Humor him, and he'll go away again

http://j-walk.com/blog/docs/conference.htm
http://www.billy.demon.nl
Mail: [EMAIL PROTECTED]



-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk







-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to