because I am currently hit by several 10.000 new type of spam using
domains like www.(meds|pill|shop)XX.(net|com|org) I sugest you to put
the following in your spamassassin config:
----[ '~/.spamassassin/user_prefs' ]------------------------------------
body AE_MEDS35 /\(\s?w{2,4}\s(?:meds|pill|shop)\d{1,4}\s(?=
:net|com|org)\s?\)/
describe AE_MEDS35 obfuscated domain seen in spam
score AE_MEDS35 3.00
------------------------------------------------------------------------
Works perfectly and has today catched over 63.000 spams on my server.
--
Haeufig gestellte Fragen und Antworten (FAQ):
http://www.de.debian.org/debian-user-german-FAQ/
Zum AUSTRAGEN schicken Sie eine Mail an debian-user-german-REQUEST@lists.debian.org
mit dem Subject "unsubscribe". Probleme? Mail an listmaster@lists.debian.org (engl)
Cette action est irreversible, confirmez la suppression du commentaire ?
Signaler le commentaire
Veuillez sélectionner un problème
Nudité
Violence
Harcèlement
Fraude
Vente illégale
Discours haineux
Terrorisme
Autre
Maximiliano Marin Bustos
On Fri, Jun 26, 2009 at 3:35 PM, Michelle Konzack wrote:
Hello,
because I am currently hit by several 10.000 new type of spam using domains like www.(meds|pill|shop)XX.(net|com|org) I sugest you to put the following in your spamassassin config:
----[ '~/.spamassassin/user_prefs' ]------------------------------------ body AE_MEDS35 /(s?w{2,4}s(?:meds|p ill|shop)d{1,4}s(?:net|com|org)s?)/ describe AE_MEDS35 obfuscated domain seen in s pam score AE_MEDS35 3.00 ------------------------------------------------------------------------
Works perfectly and has today catched over 63.000 spams on my server.
-- Linux-User #280138 with the Linux Counter, http://counter.li.org/ ##################### Debian GNU/Linux Consultant ##################### <http://www.tamay-dogan.net/> Michelle Ko nzack <http://www.can4linux.org/> c/o Vertr iebsp. KabelBW <http://www.flexray4linux.org/> Blumenstrasse 2 Jabber 77694 Kehl/German y IRC #Debian (irc.icq.com) Tel. DE : +49 177 9351947 ICQ #328449886 Tel. FR: +33 6 61925193
Michelle: Thank you for your advice!
-- Atte, Maximiliano Marin http://blog.maximilianomarin.com
-- Haeufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/
Zum AUSTRAGEN schicken Sie eine Mail an mit dem Subject "unsubscribe". Probleme? Mail an (engl)
On Fri, Jun 26, 2009 at 3:35 PM, Michelle
Konzack<linux4michelle@tamay-dogan.net> wrote:
Hello,
because I am currently hit by several 10.000 new type of spam using
domains like www.(meds|pill|shop)XX.(net|com|org) I sugest you to put
the following in your spamassassin config:
----[ '~/.spamassassin/user_prefs' ]------------------------------------
body AE_MEDS35 /(s?w{2,4}s(?:meds|p ill|shop)d{1,4}s(?:net|com|org)s?)/
describe AE_MEDS35 obfuscated domain seen in s pam
score AE_MEDS35 3.00
------------------------------------------------------------------------
Works perfectly and has today catched over 63.000 spams on my server.
--
Linux-User #280138 with the Linux Counter, http://counter.li.org/
##################### Debian GNU/Linux Consultant #####################
<http://www.tamay-dogan.net/> Michelle Ko nzack
<http://www.can4linux.org/> c/o Vertr iebsp. KabelBW
<http://www.flexray4linux.org/> Blumenstrasse 2
Jabber linux4michelle@jabber.ccc.de 77694 Kehl/German y
IRC #Debian (irc.icq.com) Tel. DE : +49 177 9351947
ICQ #328449886 Tel. FR: +33 6 61925193
Michelle: Thank you for your advice!
--
Atte,
Maximiliano Marin
http://blog.maximilianomarin.com
--
Haeufig gestellte Fragen und Antworten (FAQ):
http://www.de.debian.org/debian-user-german-FAQ/
Zum AUSTRAGEN schicken Sie eine Mail an debian-user-german-REQUEST@lists.debian.org
mit dem Subject "unsubscribe". Probleme? Mail an listmaster@lists.debian.org (engl)
On Fri, Jun 26, 2009 at 3:35 PM, Michelle Konzack wrote:
Hello,
because I am currently hit by several 10.000 new type of spam using domains like www.(meds|pill|shop)XX.(net|com|org) I sugest you to put the following in your spamassassin config:
----[ '~/.spamassassin/user_prefs' ]------------------------------------ body AE_MEDS35 /(s?w{2,4}s(?:meds|p ill|shop)d{1,4}s(?:net|com|org)s?)/ describe AE_MEDS35 obfuscated domain seen in s pam score AE_MEDS35 3.00 ------------------------------------------------------------------------
Works perfectly and has today catched over 63.000 spams on my server.
Now we have a problem because the spam is something like
www meds88 com www . meds88 . com
and the rule is working fine, and now it stoped at:
www. meds88. com
Can you try now:
body AE_MEDS35 /bwww(?:sW?s?|Ws)w{3,6}d{2,6}(?:s W?s?|Ws)(?:cs?os?m|ns?es?t|os?rs?g)b/i describe AE_MEDS35 obfuscated domain seen in spam score AE_MEDS35 3.00
Now we have a problem because the spam is something like
www meds88 com
www . meds88 . com
and the rule is working fine, and now it stoped at:
www. meds88. com
Can you try now:
body AE_MEDS35 /bwww(?:sW?s?|Ws)w{3,6}d{2,6}(?:s W?s?|Ws)(?:cs?os?m|ns?es?t|os?rs?g)b/i
describe AE_MEDS35 obfuscated domain seen in spam
score AE_MEDS35 3.00
--
Haeufig gestellte Fragen und Antworten (FAQ):
http://www.de.debian.org/debian-user-german-FAQ/
Zum AUSTRAGEN schicken Sie eine Mail an debian-user-german-REQUEST@lists.debian.org
mit dem Subject "unsubscribe". Probleme? Mail an listmaster@lists.debian.org (engl)
Now we have a problem because the spam is something like
www meds88 com www . meds88 . com
and the rule is working fine, and now it stoped at:
www. meds88. com
Can you try now:
body AE_MEDS35 /bwww(?:sW?s?|Ws)w{3,6}d{2,6}(?:s W?s?|Ws)(?:cs?os?m|ns?es?t|os?rs?g)b/i describe AE_MEDS35 obfuscated domain seen in spam score AE_MEDS35 3.00
