Hey guys, over the last few weeks we got a lot of spam that only contains links like that:
http://bbsmo.mn/tmushztx/lzujztbkfwjqoqbftqszyemmckhrzhjakfxt.gikbhdnmpnszahgui http://magopro.fr/nb/hnsmixxmpkxogwclpqlqocrjzpx.dlnafduhnsrbgrokhsjbloszzkgjjt All of these links are just redirects to the same website. We got this spam from different senders and servers. Amavis/Spamassassin scores this mails with 2 – 5 points. e.g. X-Spam-Status: No, score=2.999 tagged_above=2 required=6.9 tests=[DATE_IN_PAST_96_XX=2.07, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SUBJ_ALL_CAPS=1.625, TVD_SPACE_RATIO=0.001, URIBL_BLOCKED=0.001] X-Spam-Status: No, score=4.926 tagged_above=2 required=6.9 tests=[DATE_IN_PAST_96_XX=2.07, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SUBJ_ALL_CAPS=1.625, URIBL_BLOCKED=0.001, URIBL_JP_SURBL=1.948] What is the “best practice” Spamassassin rule to avoid spam like that? Kind regards FALKE KGaA OSTSTRASSE 5, D-57392 SCHMALLENBERG / GERMANY KOMPLEMENTÄRE: FALKE BETEILIGUNGS-OHG FRANZ-PETER FALKE GMBH · PAUL FALKE GMBH VORSITZENDER DES AUFSICHTSRATS: DR. REINHARD ZINKANN · AG ARNSBERG HRB 7738 www.FALKE.com
