> |-----Original Message----- > |From: Evan Platt [mailto:[EMAIL PROTECTED] > |Sent: Wednesday, January 21, 2004 15:03 > |To: SpamAssassin > |Subject: Re: [SAtalk] How to stop this kind of stuff?
Real easy, this is a predictable spamhaus, "Empire Towers" Go check the records on this outfit at http://www.spamhaus.org/rokso Just add two custom rules to your SA kit: One that hits any uri reference to "opt-u1.biz" hard (I give it a 8.0) The other looks for any of optny?.us or optny?.biz (where the ? is a digit) in the 'From' header and hits that hard too. uri L_SPAMHAUS1 /\b(?:opt-u1\.biz|certrewards\.tc|funding-advisors\.com)\b/i describe L_SPAMHAUS1 Contains URI refering to Empire Towers Spamhaus score L_SPAMHAUS1 8.0 header L_SPAMHAUS2 From =~ /\boptny\d\.(?:us|biz)\b/i describe L_SPAMHAUS2 Sent from Empire Towers Spamhaus score L_SPAMHAUS2 8.0 Dave -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{ ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
