Re: [SA Rule] meds, pill and shop spams
On Fri, Jun 26, 2009 at 3:35 PM, Michelle
Konzack<linux4michelle@tamay-dogan.net> wrote:
> Hello,
>
> because I am currently hit by several 10.000 new type of spam using
> domains like www.(meds|pill|shop)XX.(net|com|org) I sugest you to put
> the following in your spamassassin config:
>
> ----[ '~/.spamassassin/user_prefs' ]------------------------------------
> body AE_MEDS35 /\(\s?w{2,4}\s(?:meds|pill|shop)\d{1,4}\s(?:net|com|org)\s?\)/
> describe AE_MEDS35 obfuscated domain seen in spam
> score AE_MEDS35 3.00
> ------------------------------------------------------------------------
>
> Works perfectly and has today catched over 63.000 spams on my server.
>
> Thanks, Greetings and nice Day/Evening
> Michelle Konzack
> Systemadministrator
> 25.9V Electronic Engineer
> Tamay Dogan Network
> Debian GNU/Linux Consultant
>
> --
> Linux-User #280138 with the Linux Counter, http://counter.li.org/
> ##################### Debian GNU/Linux Consultant #####################
> <http://www.tamay-dogan.net/> Michelle Konzack
> <http://www.can4linux.org/> c/o Vertriebsp. KabelBW
> <http://www.flexray4linux.org/> Blumenstrasse 2
> Jabber linux4michelle@jabber.ccc.de 77694 Kehl/Germany
> IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947
> ICQ #328449886 Tel. FR: +33 6 61925193
>
Michelle: Thank you for your advice!
--
Atte,
Maximiliano Marin
http://blog.maximilianomarin.com
Reply to: