Re: blogspot spam

2008-03-21 Thread Arvid Ephraim Picciani
On Friday 21 March 2008 04:27:05 Loren Wilton wrote: body SOFTWARE_AD /(?:|\bbezahlen.*runterladen|Windows\bund\bmit\bMacintosh|\bOriginalversion en\b.*\blegal\b)/i You probably want to adjust this a little bit. There are a few things here that make me think you aren't getting quite what

Re: blogspot spam

2008-03-20 Thread Benny Pedersen
On Wed, March 19, 2008 13:21, James E. Pratt wrote: http://pastebin.com/m8520d64 http://pastebin.com/m159c02de http://www.gossamer-threads.com/lists/spamassassin/users/90664 Botnet plugin hits them nicely Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: blogspot spam

2008-03-20 Thread Arvid Ephraim Picciani
On Wednesday 19 March 2008 21:37:27 Loren Wilton wrote: This is just off the top of my head, and needs linting and maybe tweaking the scores. uriBAD_BLOGSPOTm'http://[a-z]+\d+\.blogspot\.com'i scoreBAD_BLOGSPOT1 body__SOFTWARES

Re: blogspot spam

2008-03-20 Thread Loren Wilton
body SOFTWARE_AD /(?:|\bbezahlen.*runterladen|Windows\bund\bmit\bMacintosh|\bOriginalversionen\b.*\blegal\b)/i You probably want to adjust this a little bit. There are a few things here that make me think you aren't getting quite what you expect. 1.Remove that first vertical bar.

Re: blogspot spam

2008-03-19 Thread Arvid Ephraim Picciani
On Wednesday 19 March 2008 13:21:20 James E. Pratt wrote: Hi. I'm seeing lots of these get by: http://pastebin.com/m8520d64 anyone have a rule for these? The last one I put up is at: http://pastebin.com/m159c02de Thanks, Jamie yeah exactly my issue. the site is in uribl already but

Re: blogspot spam

2008-03-19 Thread Yet Another Ninja
On 3/19/2008 1:24 PM, Arvid Ephraim Picciani wrote: On Wednesday 19 March 2008 13:21:20 James E. Pratt wrote: Hi. I'm seeing lots of these get by: http://pastebin.com/m8520d64 anyone have a rule for these? The last one I put up is at: http://pastebin.com/m159c02de Thanks, Jamie yeah

RE: blogspot spam

2008-03-19 Thread Michael Hutchinson
-Original Message- From: Yet Another Ninja [mailto:[EMAIL PROTECTED] Sent: Thursday, 20 March 2008 1:48 a.m. To: Arvid Ephraim Picciani Cc: users@spamassassin.apache.org Subject: Re: blogspot spam On 3/19/2008 1:24 PM, Arvid Ephraim Picciani wrote: On Wednesday 19 March 2008 13

RE: blogspot spam

2008-03-19 Thread Evan Platt
At 12:48 PM 3/19/2008, Michael Hutchinson wrote: For those that don't run SA 3.2.3, you could test this rule: uri CST_URI_BLOGSPOTm,http://\w+\.blogspot\.com\b, describe CST_URI_BLOGSPOT blogspot.com throwaway URI score CST_URI_BLOGSPOT 3.4 A few people disagree

Re: blogspot spam

2008-03-19 Thread Arvid Ephraim Picciani
On Wednesday 19 March 2008 20:48:00 Michael Hutchinson wrote: For those that don't run SA 3.2.3, you could test this rule: uri CST_URI_BLOGSPOTm,http://\w+\.blogspot\.com\b, describe CST_URI_BLOGSPOT blogspot.com throwaway URI score CST_URI_BLOGSPOT 3.4 thanks Mike,

Re: blogspot spam

2008-03-19 Thread Loren Wilton
http://pastebin.com/m8520d64 http://pastebin.com/m159c02de This is just off the top of my head, and needs linting and maybe tweaking the scores. uriBAD_BLOGSPOTm'http://[a-z]+\d+\.blogspot\.com'i scoreBAD_BLOGSPOT1 body__SOFTWARES

RE: blogspot spam

2008-03-19 Thread Michael Hutchinson
-Original Message- From: Arvid Ephraim Picciani [mailto:[EMAIL PROTECTED] Sent: Thursday, 20 March 2008 9:04 a.m. To: users@spamassassin.apache.org Subject: Re: blogspot spam On Wednesday 19 March 2008 20:48:00 Michael Hutchinson wrote: For those that don't run SA 3.2.3, you