On Tuesday 16 August 2005 03:47 pm, Jon Drukman wrote:
> I'm getting a lot of spams slipping thru the net lately. They hit
> BAYES_99 and nothing else, usually, because they contain almost no
> content other than a URL:
>
> http://uk.geocities.com/Robt_Bright/?M0v=Make.your.day_enjoyable.without
Getting all of this crap blocked here using:
uri SENET_GEOCITIES /[a-z]+\.geocities\.com\/[0-9a-zA-Z\-_\.\,]+/i
describe SENET_GEOCITIES Link to freebie geocities.com web site
score SENET_GEOCITIES 3.875
uri __GEOCITIES_NUM /\.geocities\.com\/[a-z_0-9]{1,30}/i
uri __GEOCITIES_NAME /\.geocities\.com\/[a-z]+_[a-z]+\/\?
[a-z0-9]+/i
uri __GEOCITIES_FREEBIE_UK /uk\.geocities\.com/i
meta SENET_GEOCITIES_PORN (SUBJECT_SEXUAL && __GEOCITIES_NUM)
describe SENET_GEOCITIES_PORN Porn site on Geocities
score SENET_GEOCITIES_PORN 6.25
meta SENET_GEOCITIES_UK (__GEOCITIES_FREEBIE_UK)
describe SENET_GEOCITIES_UK Geocities UK URI
score SENET_GEOCITIES_UK 1.12
meta SENET_GEOCITIES_UK_RX (__GEOCITIES_FREEBIE_UK && __GEOCITIES_NAME)
describe SENET_GEOCITIES_UK_RX Geocities UK RX URI
score SENET_GEOCITIES_UK_RX 8.0
