Success! You know that spam with the ever changing domains? The one with the
George Bush look alike doctor that is selling 6 kinds of Mr. Wiggly
enhancing drugs? Well I finally got it right and tested!
Watch out for line wraps in your mail client. (should be 7 lines)
rawbody __VDRUG1 /^\<html\>\<body\>/
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,15}\-\-\>\<a href\=\"http\:\/\//
rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
describe MRWIGGLY Mr. Wiggly enhance drug spam.
score MRWIGGLY 1.0
Yes I know I escaped some things that didn't need to be. I have a cleaner
version, but not tested yet. You guys have turned me into a testing wuss :)
I've seen no FPs. If someone has a better way of writing this one, I'm all
for it! I'm thinking lines 1,3,and 4 might be better if they end with $/
What do you think?
And I've looked at the numbers. The spam traffic is still increasing since
the begining of the year, but my MTA level denials have also increased. The
guys at the DNSRBLs are really doing a bang up job. So the amount of spams
that gets caught for me to play with have gone down.
Man this feels good!
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of the species that survives,
not the most intelligent, but the one most responsive to change.'
Charles Darwin
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
