[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [SA Rule] meds, pill and shop spams



Hi back,

Now we have a problem because the spam is something like

    www  meds88 com
    www . meds88 . com

and the rule is working fine, and now it stoped at:

    www.  meds88.  com

Can you try now:

body            AE_MEDS35       /\bwww(?:\s\W?\s?|\W\s)\w{3,6}\d{2,6}(?:\s\W?\s?|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
describe        AE_MEDS35       obfuscated domain seen in spam
score           AE_MEDS35       3.00

which should catch it...

Thanks, Greetings and nice Day/Evening
    Michelle Konzack
    Systemadministrator
    Tamay Dogan Network
    Debian GNU/Linux Consultant

-- 
Linux-User #280138 with the Linux Counter, http://counter.li.org/
##################### Debian GNU/Linux Consultant #####################
<http://www.tamay-dogan.net/>                 Michelle Konzack
<http://www.can4linux.org/>                   c/o Vertriebsp. KabelBW
<http://www.flexray4linux.org/>               Blumenstrasse 2
Jabber linux4michelle@jabber.ccc.de           77694 Kehl/Germany
IRC #Debian (irc.icq.com)                     Tel. DE: +49 177 9351947
ICQ #328449886                                Tel. FR: +33  6  61925193

Attachment: signature.pgp
Description: Digital signature


Reply to: