JP Kelly wrote:
From: [EMAIL PROTECTED]
Subject: She'll Beg for More..
Date: January 21, 2008 10:34:15 AM PST
To: [EMAIL PROTECTED]
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
jpkvideo.net
X-Spam-Level: ****
X-Spam-Status: No, score=4.5 required=5.0
tests=BAYES_99,MISSING_MID, RCVD_IN_PBL,RDNS_DYNAMIC autolearn=no
version=3.2.3
Received: (qmail 8030 invoked by uid 110); 21 Jan 2008 08:35:21 -0800
Received: (qmail 7999 invoked from network); 21 Jan 2008 08:35:20
-0800
Received: from 190.75-207-15.dyn.dsl.cantv.net (HELO
equipo05.cantv.net) (190.75.207.15) by smallgod.com with SMTP; 21 Jan
2008 08:35:19 -0800
Received-Spf: none (smallgod.com: domain at bloggingstocks.com
does not designate permitted sender hosts)
Content-Transfer-Encoding: 7bit
body:
------------------------------
Mon, 21 Jan 2008 17:34:15 -0100
http://google.com//search?hl=en&q=inurl:rhtawy.com%2BVPXL%2BMade%2BEasy&btnI=79547
so that's similar to the one discussed in the thread
"Re: Googlepages & Livefilestore spams"
see that thread and look for a message by Ben Lentz (10-10-2008 04:56).
maybe something like this (Warning: untested):
uri GOOGLE_SEARCH_BTNI m{gooo?gle\..*/search.*btnI=}
score GOOGLE_SEARCH_BTNI 2.0
describe GOOGLE_SEARCH_BTNI contains
PS. who is smallgod.com? I would block the blasphematory MTA ;-p
If it's your MTA, then see if the PBL is safe for you to use at the MTA
level.
