On Wednesday 19 March 2008 21:37:27 Loren Wilton wrote:
> This is just off the top of my head, and needs linting and maybe tweaking
> the scores.
>
> uri BAD_BLOGSPOT m'http://[a-z]+\d+\.blogspot\.com'i
> score BAD_BLOGSPOT 1
>
> body __SOFTWARES /(?:product|software|softs|opportunity|oem|best
> prices|low prices|discount|cheap)/i
>
> meta BLOG_SOFTWARE BAD_BLOGSPOT && __SOFTWARES
> score BLOG_SOFTWARE 3.5
>
> Mind the wrap!
yes! thanks a lot. based on that wrap i figured i could glue it with uri grey
(yes uribl is listing geocities in grey now)
body SOFTWARE_AD /(?:|\bbezahlen.*runterladen|
Windows\bund\bmit\bMacintosh|\bOriginalversionen\b.*\blegal\b)/i
score SOFTWARE_AD 0.5
describe SOFTWARE_AD advertising software
meta SOFT_AND_URIGREY URIBL_GREY && SOFTWARE_AD
score SOFT_AND_URIGREY 3.0
describe SOFT_AND_URIGREY contains both an url in the URIBL greylist and
software advertisement
that helps a lot.
Content analysis details: (10.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 SOFTWARE_AD BODY: advertising software
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[79.6.185.72 listed in dnsbl.sorbs.net]
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[79.6.185.72 listed in zen.spamhaus.org]
0.8 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[79.6.185.72 listed in zen.spamhaus.org]
1.0 URIBL_GREY Contains an URL listed in the URIBL greylist
[URIs: geocities.com]
3.0 SOFT_AND_URIGREY contains both an url in the URIBL greylist and
software advertisement
--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani
