On Wednesday 19 March 2008 21:37:27 Loren Wilton wrote: > This is just off the top of my head, and needs linting and maybe tweaking > the scores. > > uri BAD_BLOGSPOT m'http://[a-z]+\d+\.blogspot\.com'i > score BAD_BLOGSPOT 1 > > body __SOFTWARES /(?:product|software|softs|opportunity|oem|best > prices|low prices|discount|cheap)/i > > meta BLOG_SOFTWARE BAD_BLOGSPOT && __SOFTWARES > score BLOG_SOFTWARE 3.5 > > Mind the wrap! yes! thanks a lot. based on that wrap i figured i could glue it with uri grey (yes uribl is listing geocities in grey now)
body SOFTWARE_AD /(?:|\bbezahlen.*runterladen| Windows\bund\bmit\bMacintosh|\bOriginalversionen\b.*\blegal\b)/i score SOFTWARE_AD 0.5 describe SOFTWARE_AD advertising software meta SOFT_AND_URIGREY URIBL_GREY && SOFTWARE_AD score SOFT_AND_URIGREY 3.0 describe SOFT_AND_URIGREY contains both an url in the URIBL greylist and software advertisement that helps a lot. Content analysis details: (10.5 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.5 SOFTWARE_AD BODY: advertising software 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address [79.6.185.72 listed in dnsbl.sorbs.net] 3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL [79.6.185.72 listed in zen.spamhaus.org] 0.8 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL [79.6.185.72 listed in zen.spamhaus.org] 1.0 URIBL_GREY Contains an URL listed in the URIBL greylist [URIs: geocities.com] 3.0 SOFT_AND_URIGREY contains both an url in the URIBL greylist and software advertisement -- best regards/Mit freundlichen Grüßen Arvid Ephraim Picciani