spamassassin rule - VOID_GEOCITIES

[Void Main]

I've been getting at least 5 to 10 SPAM messages a day with a link to some page on uk.geocities.com. I have a large number of extra rules that I keep updated with the RulesDuJour script and these messages have been making it through. The SPAM is so nice it gets marked as ham much of the time. I wrote a rule to catch this. Since doing so not one single SPAM message has made it into my inbox. Here's the rule:

/etc/mail/spamassassin/void_geocities.cf

Code: Select all

body VOID_GEOCITIES       /http\:\/\/uk\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://uk.geocities.com/xxxx/?xxxx in body is SPAM


I run Sendmail+clamav+spamassassin for a mail server. I don't know why I run clamav, just a waste of CPU cycles at my house. :)

[Void Main]

Updated:

Code: Select all

body VOID_GEOCITIES       /http\:\/\/(uk|it|de)\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://*.geocities.com/xxxx/?xxxx in body is SPAM


[Void Main]

Update:

http://voidmain.is-a-geek.net/files/misc/voidmain.cf

Code: Select all

body VOID_GEOCITIES       /http\:\/\/.*\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://*.geocities.com/*/?* in body

body VOID_GEOYAHOO       /http\:\/\/geocities\.yahoo\.com\..*\/.*\/\?/
score VOID_GEOYAHOO      5.1
describe VOID_GEOYAHOO   http://geocities.yahoo.com.*/*/?* in body

body VOID_BEDSLIME       /http\:\/\/.*bedslime\.com\/.*\//
score VOID_BEDSLIME      5.1
describe VOID_BEDSLIME   http://*bedslime.com/*/ in body


[Calum]

what is ham?

[Void Main]

The opposite of spam (good mail).

[Void Main]

Update again:
http://voidmain.is-a-geek.net/files/misc/voidmain.cf

Code: Select all

body VOID_GEOCITIES       /http\:\/\/.*\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://*.geocities.com/*/?* in body

body VOID_GEOYAHOO       /http\:\/\/geocities\.yahoo\.com\..*\/.*\/\?/
score VOID_GEOYAHOO      5.1
describe VOID_GEOYAHOO   http://geocities.yahoo.com.*/*/?* in body

body VOID_BEDSLIME       /http\:\/\/.*bedslime\.com\//
score VOID_BEDSLIME      5.1
describe VOID_BEDSLIME   http://*bedslime.com/ in body

body VOID_THE18       /http\:\/\/.*the1877l\.net\//
score VOID_THE18      5.1
describe VOID_THE18   http://*the1877l.net/ in body


[Void Main]

Updated again:

Code: Select all

rawbody VOID_GEOCITIES       /http\:\/\/.*\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://*.geocities.com/*/?* in body

rawbody VOID_GEOYAHOO       /http\:\/\/geocities\.yahoo\.com\..*\/.*\/\?/
score VOID_GEOYAHOO      5.1
describe VOID_GEOYAHOO   http://geocities.yahoo.com.*/*/?* in body

rawbody VOID_BEDSLIME       /http\:\/\/.*bedslime\.com\//
score VOID_BEDSLIME      5.1
describe VOID_BEDSLIME   http://*bedslime.com/ in body

rawbody VOID_THE18       /http\:\/\/.*the1877l\.net\//
score VOID_THE18      5.1
describe VOID_THE18   http://*the1877l.net/ in body


[Void Main]

Update:
http://voidmain.is-a-geek.net/files/misc/void.cf

Code: Select all

rawbody VOID_GEOCITIES       /http\:\/\/.*\.geocities\.com\/.*\//
score VOID_GEOCITIES           5.1
describe VOID_GEOCITIES       http://*.geocities.com/*/ in body

rawbody VOID_GEOYAHOO       /http\:\/\/geocities\.yahoo\.com\..*\/.*\//
score VOID_GEOYAHOO           5.1
describe VOID_GEOYAHOO       http://geocities.yahoo.com.*/*/ in body

rawbody VOID_BEDSLIME         /http\:\/\/.*bedslime\.com\//
score VOID_BEDSLIME             5.1
describe VOID_BEDSLIME         http://*bedslime.com/ in body

rawbody VOID_THE18               /http\:\/\/.*the1877l\.net\//
score VOID_THE18                   5.1
describe VOID_THE18               http://*the1877l.net/ in body

rawbody VOID_LOVE                 /http\:\/\/.*-love-.*\.us\//
score VOID_LOVE                     5.1
describe VOID_LOVE                 http://*-love-*.us/ in body