This is what my rules look like now:

uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/index\/form1.html/
score LOCAL_URI_EXAMPLE 200
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/nana\/form1.html/
score LOCAL_URI_EXAMPLE 100
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/ontokoros\/form1.html/
score LOCAL_URI_EXAMPLE 100
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/tbt\/form1.html/
score LOCAL_URI_EXAMPLE 200
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/webadmin\/form1.html/
score LOCAL_URI_EXAMPLE 200

I took out the last "/" as you suggested...thanks.


There's nothing in the header of the emails that indicates it went through
spamassassin - is there a way to use a spamassassin command to test out the
rules?

Thanks again for your help.




Bowie Bailey wrote:
> 
> On 3/1/2011 12:39 PM, tr_ust wrote:
>> Thanks...I could really use the help!  
>>
>> basically - I'm getting the list of phishing links of aper
>> (https://aper.svn.sourceforge.net/svnroot/aper/) and creating a rule for
>> it. 
>>
>> Here's a snippet of my rule -
>>
>> uri LOCAL_URI_EXAMPLE /-la2u.9hz.com\//
>> score LOCAL_URI_EXAMPLE 20
>> uri LOCAL_URI_EXAMPLE /0-vgj.9hz.com\//
>> score LOCAL_URI_EXAMPLE 20
>> uri LOCAL_URI_EXAMPLE /007vt.9hz.com\//
>> score LOCAL_URI_EXAMPLE 20
>> uri LOCAL_URI_EXAMPLE /02khw.9hz.com\//
>> score LOCAL_URI_EXAMPLE 10
>> uri LOCAL_URI_EXAMPLE /03l6c.9hz.com\//
>> score LOCAL_URI_EXAMPLE 50
>> uri LOCAL_URI_EXAMPLE /03ysl.9hz.com\//
>> score LOCAL_URI_EXAMPLE 20
>> uri LOCAL_URI_EXAMPLE /040jk.9hz.com\//
>> score LOCAL_URI_EXAMPLE 20
>> uri LOCAL_URI_EXAMPLE /0oczg.9hz.com\//
>> score LOCAL_URI_EXAMPLE 20
>>
>>
>> I'm using the per user option right now for spamassassin, so I test it by
>> sending the user an email with one of these links...and it's still going
>> through.
> 
> You are aware that these rules are specifying that there MUST be a slash
> after .com in order to match, right?
> 
> Other than that, I don't see any obvious problem.  Send an example email
> through your system and put the resulting email (with headers) into a
> pastebin so I can look at it.
> 
> -- 
> Bowie
> 
> 

-- 
View this message in context: 
http://old.nabble.com/new-rules---where-do-i-activate-them--tp31008400p31050515.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Reply via email to