> -----Original Message----- > From: Yet Another Ninja [mailto:[EMAIL PROTECTED] > Sent: Thursday, 20 March 2008 1:48 a.m. > To: Arvid Ephraim Picciani > Cc: users@spamassassin.apache.org > Subject: Re: blogspot spam > > On 3/19/2008 1:24 PM, Arvid Ephraim Picciani wrote: > > On Wednesday 19 March 2008 13:21:20 James E. Pratt wrote: > >> Hi. I'm seeing lots of these get by: > >> > >> http://pastebin.com/m8520d64 > >> > >> anyone have a rule for these? > >> > >> The last one I put up is at: > >> > >> http://pastebin.com/m159c02de > >> > >> Thanks, > >> > >> Jamie > > > > yeah exactly my issue. the site is in uribl already but sa doesn't work > with > > uribl and subdomains. see previous posts. > > SARE_OEM helps a little. > > > > it does work! > > if runing > SA 3.2.3 add to local.cf: > > util_rb_2tld blogspot.com >
For those that don't run SA 3.2.3, you could test this rule: uri CST_URI_BLOGSPOT m,http://\w+\.blogspot\.com\b, describe CST_URI_BLOGSPOT blogspot.com throwaway URI score CST_URI_BLOGSPOT 3.4 A few people disagree with this, as it will score against legitimate email for some domains. I created it for our site as we do not receive newsletters with blogspot links, so we hose the emails with 3.4 points, which is enough to push them over the 5.0 threshold, as they score on other rules too. Be warned, beware, don't use this unless you're really sure you don't want blogspot links in emails. Customers might become annoyed. (Ours haven't, though, and it's been a month). Cheers, Mike
