On Wed, 2005-11-09 at 23:47 +0100, Raymond Dijkxhoorn wrote:
> Hi!
>
> >> A slightly earlier one got a much lower score with:
> >>
> >
> > Umm... I don't see any SARE rules in there. The fact is, SARE isn't
> > terribly effective against these 1-column drug spams. The only SARE hit
> > I got was SARE_SPEC_LEO_LINE03f with a whopping 0.18 points, or
> > occasionally SARE_SPEC_LEO_MEDS with 1.67 points.
>
> SARE rules will be updates shortly.
>
> > Sure, with every possible network test enabled you will catch most
> > everything. But some of us don't have unlimited resources. ;)
>
> body PROLO_LEO1 /85\,45|1\,21/
> body PROLO_LEO2 /69\,95|3\,33/
> body PROLO_LEO3 /99\,95|3\,75/
> uri PROLO_LEO4 /http:\/\/.*\.tripod\.com/
> meta PROLO_LEO_M1 (PROLO_LEO1 && PROLO_LEO2 &&
> PROLO_LEO3 && PROLO_LEO4)
>
> score PROLO_LEO1 0.1
> score PROLO_LEO2 0.1
> score PROLO_LEO3 0.1
> score PROLO_LEO4 0.1
> score PROLO_LEO_M1 8
>
> describe PROLO_LEO1 Meta Catches all Leo drug variations
> so far
> describe PROLO_LEO2 Meta Catches all Leo drug variations
> so far
> describe PROLO_LEO3 Meta Catches all Leo drug variations
> so far
> describe PROLO_LEO4 Meta to catch Leo now using Tripod
> describe PROLO_LEO_M1 Catches all Leo drug variations so far
>
> Meanwhile you could use something like this.
>
> We have some other ones, since Leo likes to morph, but this ons is pretty
> effective on the current ones.
Update to catch latest variations:
body PROLO_LEO1 /85\,45|1\,21|1\,22/
body PROLO_LEO2 /69\,95|3\,33|3\,32/
-Bill
