Yea...here is an example. They are getting through here to and I have everything turned on except dcc and razor. Here is an example. Hopefully they will use up all their spam IPs and start getting blocked by RBLs. These type break-throughs usually don't last too long.
-----------------start--------------------- Subject: Expect it. Reduce prices on tiptop ointment at our chemisst site. :-) Your services are really convenient. With on time delivery, I got the stuff without any delay. I will refer your site to others who like to cut costs on remeddy. -- william Deiters in DC. What is the real issue? Gain quicker curatives? Fight the discomforts with our assistance. Stay away from bad heaadaches, sevvere stress, embarrassing disorrders, and unheealthy ccholesterol. We dispense a great aassortment of genericcs for sshopper's convenience. http://uk.geocities.com/Adan_smith001/?q=RLbQ3BdGeWgQY While she remained, a bush of low rambling holly protected her, undertaken a pilgrimage to the grave of Homer. Among the strangers was a minstrel from the north, the home of the clouds and the brilliant could be properly interesting only to the principals. Mrs Croft ------------------end------------------------------- Also....another like above had the spam link http://uk.geocities.com/andy_grove95/?q=MPqr1uWa5gJqTNfs -----Original Message----- From: Kelson [mailto:[EMAIL PROTECTED] Sent: Friday, August 05, 2005 6:03 PM To: users@spamassassin.apache.org Subject: GeoCities Link-only spam Over the last few days, we've been seeing a lot of spam that contains nothing but a pair of names and a link to a URL at uk.geocities.com. No image, no obfuscation, only a small percent has any bayes poison. Just the link and two names. Most of it is pill spam, some mortgage. SURBL can't catch it, because all it sees is geocities.com. Some of have tripped SARE header tests, but most haven't. Even when they trip BAYES_99, often the only other rule is something like one of the DATE_IN_PAST rules, which isn't enough to push it over the edge. I finally just added a URI rule, which seems fine (since, IIRC, this would mean someone at GeoCities with the username "uk") and we've logged 150 of them in the past few hours. Is anyone else seeing these? -- Kelson Vibber SpeedGate Communications <www.speed.net>
