Just got a spam for a blog spamming tool named "Blog Blaster". It
didn't score high enough to be auto-discarded, so I added some rules.
I case anybody else is interested:
describe BBLAST_01 Blog Blaster
body BBLAST_01 /Blog\s+Blaster/
score BBLAST_01 1.00
describe BBLAST_02 Blog Blaster your ad
body BBLAST_02 /Blog\s+Blaster\s.{0,80}\syour\s+(?:ad|website)/i
score BBLAST_02 1.00
describe BBLAST_03 Blog Blaster advertising
body BBLAST_03 /advertis.{0,80}Blog\s+Blaster/i
score BBLAST_03 1.00
describe BBLAST_04 Blog Blaster volume
body BBLAST_04 /Blog\s+Blaster\s.{0,80}\s+(?:thousand|million)/i
score BBLAST_04 1.00
describe BBLAST_H_01 Blog Blaster From
header BBLAST_H_01 From =~ /blogblast/i
score BBLAST_H_01 1.00
describe BBLAST_H_02 Blog Blaster Reply-To
header BBLAST_H_02 Reply-To =~ /blogblast/i
score BBLAST_H_02 1.00
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
[EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED]
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...to announce there must be no criticism of the President or to
stand by the President right or wrong is not only unpatriotic and
servile, but is morally treasonous to the American public.
-- Theodore Roosevelt, 1918
-----------------------------------------------------------------------
14 days until The 219th anniversary of the signing of the U.S. Constitution
