Here is a rule I love! It is one of the few I score aggressivly. I'm well aware of some of the FPs, but I counter with some nice Whitelists and negative rules.
The rule is likely broken up by your mail browser. IT should be 3 lines long ;) header MY_DSL Received =~ /\.atlantabroadband\.com|customer|ppp|poole?s?|modem|cable|node|adsl|dial|ds l|client|(insight|tampabay|maine|nyc|nc|cinci)\.rr\.com|vc\.shawcable\.net|s e\.client..?\.attbi\.com|\.(east|west)\.verizon\.net|(nj|sc)\.comcast\.net|\ .dis.net|\.charter.com|metropolis\-inter\.com/i describe MY_DSL Contains likely dsl address in header score MY_DSL 3.0 For more rules, see the link in my sig and also www.exit0.us Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka > -----Original Message----- > From: Peter Kiem [mailto:[EMAIL PROTECTED] > Sent: Wednesday, September 17, 2003 8:41 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Recognising dynamic rr.com IPs > > > I'm getting sick of all the spam that comes from rr.com and have been > blocking based on client addresses like houston.rr.com, nyc.rr.com, > satx.rr.com etc but they seem to have LOTS of pools like this. > > Does anyone know a regexp to detect either > 1) the dynamic rr.com pools for blacklisting; or > 2) the legal rr.com mailservers for whitelisting? > > -- > Regards, > +-----------------------------+---------------------------------+ > | Peter Kiem .^. | E-Mail : <[EMAIL PROTECTED]> | > | Zordah IT /V\ | Mobile : +61 0414 724 766 | > | IT Consultancy & /( )\ | WWW : www.zordah.net | > | Internet Services ^^-^^ | ICQ : "Zordah" 866661 | > +-----------------------------+---------------------------------+ > My current spamtrap address is [EMAIL PROTECTED] > > > ------------------------------------------------------- > This sf.net email is sponsored by:ThinkGeek > Welcome to geek heaven. > http://thinkgeek.com/sf > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
