From: "Robert Menschel" <[EMAIL PROTECTED]>
Hello Brian,
Wednesday, September 14, 2005, 5:31:34 AM, you wrote:
BI> Hi,
BI> The number of messages like below has increased. Unfortunately, they
are
BI> not reported to SpamCop fast enough for SURBL to handle them.... Has
anyone
BI> created some sort of filter to identify this type of messages ??
SARE rules under development. Some will be published by this weekend,
come hell or ... well, I'm not in New Orleans. Other rules we're less
sure of may wait a few more days.
Sample hit rates of the most promising rules:
#counts LW_LEO_MAILER1 2332s/0h of 679260 corpus
(323056s/356204h RM) 09/13/05
#counts LW_LEO_DOLLARS1 1451s/0h of 679260 corpus
(323056s/356204h RM) 09/13/05
#counts LW_LEO_COST 1014s/0h of 679260 corpus
(323056s/356204h RM) 09/13/05
#counts LW_LEO_DRUGS_DOWN 2563s/0h of 679260 corpus
(323056s/356204h RM) 09/13/05
#counts SARE_LEO_SUB_MEDS 1107s/0h of 614805 corpus
(315596s/299209h RM) 09/11/05
#counts SARE_LEO_SUB_PHARM 487s/0h of 614805 corpus
(315596s/299209h RM) 09/11/05
#counts SARE_LEO_SUB_PHARM2 877s/0h of 614805 corpus
(315596s/299209h RM) 09/11/05
#counts SARE_LEO_LINE02 2028s/0h of 614805 corpus
(315596s/299209h RM) 09/11/05
#counts SARE_LEO_LINE03 59s/0h of 614805 corpus
(315596s/299209h RM) 09/11/05
Oh poor poor Leo. Why'd you want to do such a nasty thing to such a nice
spammer? Now the mad Russian will have to change tactics, again.
{O,o}
(Actually there may be a very effective tool against him and the
Columbine crew if you play the DNS lookup game correctly. But it
expensive for testing purposes requiring whois lookups with
multiple DNS lookups.)
