On Tue, Sep 16, 2003 at 01:22:35PM +0200, Andrea Riela wrote: > I'm thinking on > > uri MY_SPAM_HOST > /http:\/\/(click|clix|track|adv)\d*\.\w+/i > describe MY_SPAM_HOST URL points to a server named "click" > score MY_SPAM_HOST 4.0 > > And if I've spam from evoclick.dom, or evoclix?
Speaking of "click", I've found this rule useful: body SKX_CLK /http:\/\/clk\./ describe SKX_CLK Contains http://clk.something score SKX_CLK 2.0 It catches things like: Turn it into a 150 Inch Big Screen for only $29.95! Go Here Now: http://clk.estcloud.com/tracking/go.aspx?e=41746517-1538-0-0-1356 AOL Members: <a href="http://clk.estcloud.com/tracking/go.aspx?e=41746517-1538- 0-0-1356">Go Here</a> and: =============================================== ** Earn Money For Your Opinions! ** =============================================== ====> Earn up to $50 For Your Work! http://clk.itssecuremail.com/tracking/go.aspx?e=19501868-1544-0-0-1364 -- Clay Irving <[EMAIL PROTECTED]> Colonies do not cease to be colonies because they are independent. - Benjamin Disraeli ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
