On Thursday, April 8, 2004, 10:17:46 AM, Mike Schrauder wrote: > We seem to be getting many through despite continual bayes training. > They have one URI in them and here is my rule that is getting many but not > all of them as it seems spammers have an > unlimited supply of goofy domain names registered.
> uri MIKES_URI_EVIL_DOM1 > /(we3xe|dbs54d|qwas3da|ding17|qmiakemds|8005hosting)\.(com|biz|net)/i > describe MIKES_URI_EVIL_DOM1 contains url for known med porn or cable spammer > score MIKES_URI_EVIL_DOM1 4.6 Hate to sound like a broken record, but: % egrep "we3xe|dbs54d|qwas3da|ding17|qmiakemds|8005hosting" surbl.bind 8005hosting.com IN A 127.0.0.2 dbs54d.com IN A 127.0.0.2 ding17.biz IN A 127.0.0.2 qmiakemds.com IN A 127.0.0.2 qwas3da.com IN A 127.0.0.2 we3xe.com IN A 127.0.0.2 SURBL's got your back. ;) Try it: http://www.surbl.org/ Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
