Have seen a bunch more Google "btnI" spam the past couple days, seem to be triggering just fine on the rules posted elsewhere on this thread.
However, these last bunch seem to have a trick, the only other text in the message aside from the URL seems to be a date string. Somehow that must totally be screwing with Bayes since those messages are also triggering BAYES_00 or BAYES_02 and pretty much obliterating the "btnI" scores with a high negative. I'm hesitant to train them as spam since I'm not sure whether that would do more harm. Any thoughts? Cheers, >>>>> Mike <<<<< > -----Original Message----- > From: Chip M. [mailto:[EMAIL PROTECTED] > Sent: Wednesday, January 09, 2008 5:37 PM > To: users@spamassassin.apache.org > Subject: Re: Googlepages & Livefilestore spams > > On Wed, 9 Jan 2008, Ben Lentz wrote: > >any other tips would be greatly appreciated. We obviously don't want > to > >blanket block google, but this URI redirection stuff isn't very > friendly > >when used by a spammer. > > Ben, the key is the "btnI" param, which maps to the "I'm feeling lucky" > button. > This technique appeared last summer (I deployed my non-SA-based rule on > 03-Jul-2007).
