--On Tuesday, December 18, 2007 5:01 PM -0800 Kenneth Porter <[EMAIL PROTECTED]> wrote:
I'm seeing a lot of these today, and Bayes seems to be letting a lot of them leak through. Any good rule for stopping them? The links are always to a Geocities page.
Reject mail with a URL to geocities.com. 66.218.77.68/32 is in the Spamhaus SBL, updated Dec 7. If you check URLs in messages. There are two patterns in those reported to us. I don't know enough about normal Geocities URLs to make regexps unique to these. [1] Noted at Spamhaus, these have multiword subjects and links like this after geocities.com/ BlakeStafford34/ EdmondMcfarland16/ [2] The more voluminous kind has one-word lower-case subjects and links like this after geocities.com/ a5owm7rv4ted5vt/ zoukfb127u07xzl/ e3e2jphxfamnp/ zoukfb127u07xzl/ e3e2jphxfamnp/ oifwubaqi2jd9i/ livq99cjun7m81/ Joseph Brennan Lead Email Systems Engineer Columbia University Information Technology
