None. This particular domain isn't terribly useful outside a pretty narrow locality (Arizona, US), so almost anything foreign is pretty likely to be spam.
Thanks for the rule, I may end up doing something like that. :) Jake On Sun, Mar 1, 2009 at 11:51 AM, John Lundin <[email protected]> wrote: > On Sun, Mar 01, 2009 at 09:44:00AM -0700, Jake Maul wrote: >> The domain changes, but it's virtually always in the .de TLD >> [31067] dbg: metadata: X-Relay-Countries: GB >> >> They don't seem to trigger any remote tests at all.... DNSBLs, URIBLs, >> Pyzor, Razor, or Botnet. The only local tests triggered are BAYES_99, >> MIME_HTML_ONLY, and a custom test I wrote which triggers when it sees >> the word 'drugstore' in the body, in all caps. >> >> Any ideas on how to make this a more solid hit? Anyone else seeing this? > > Hi, Jake. How much ham do you receive with a British origin, a German > domain and containing Russian URLs? > > header __T_RELAY_GB X-Relay-Countries =~ /\bGB\b/ > uri __T_URI_RU /\.ru\b/i > header __T_FROM_DE From:addr =~ /\.de\b/i > meta T_DESPAM (__T_RELAY_GB && __T_URI_RU && __T_FROM_DE) > > -- > [email protected] > "Being disintegrated makes me angry! Very angry, indeed!" > >
