spamassassin rule - VOID_GEOCITIES

Discuss Applications
Post Reply
User avatar
Void Main
Site Admin
Site Admin
Posts: 5716
Joined: Wed Jan 08, 2003 5:24 am
Location: Tuxville, USA
Contact:

spamassassin rule - VOID_GEOCITIES

Post by Void Main »

I've been getting at least 5 to 10 SPAM messages a day with a link to some page on uk.geocities.com. I have a large number of extra rules that I keep updated with the RulesDuJour script and these messages have been making it through. The SPAM is so nice it gets marked as ham much of the time. I wrote a rule to catch this. Since doing so not one single SPAM message has made it into my inbox. Here's the rule:

/etc/mail/spamassassin/void_geocities.cf

Code: Select all

body VOID_GEOCITIES       /http\:\/\/uk\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://uk.geocities.com/xxxx/?xxxx in body is SPAM
I run Sendmail+clamav+spamassassin for a mail server. I don't know why I run clamav, just a waste of CPU cycles at my house. :)

User avatar
Void Main
Site Admin
Site Admin
Posts: 5716
Joined: Wed Jan 08, 2003 5:24 am
Location: Tuxville, USA
Contact:

Post by Void Main »

Updated:

Code: Select all

body VOID_GEOCITIES       /http\:\/\/(uk|it|de)\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://*.geocities.com/xxxx/?xxxx in body is SPAM

User avatar
Void Main
Site Admin
Site Admin
Posts: 5716
Joined: Wed Jan 08, 2003 5:24 am
Location: Tuxville, USA
Contact:

Post by Void Main »

Update:

http://voidmain.is-a-geek.net/files/misc/voidmain.cf

Code: Select all

body VOID_GEOCITIES       /http\:\/\/.*\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://*.geocities.com/*/?* in body

body VOID_GEOYAHOO       /http\:\/\/geocities\.yahoo\.com\..*\/.*\/\?/
score VOID_GEOYAHOO      5.1
describe VOID_GEOYAHOO   http://geocities.yahoo.com.*/*/?* in body

body VOID_BEDSLIME       /http\:\/\/.*bedslime\.com\/.*\//
score VOID_BEDSLIME      5.1
describe VOID_BEDSLIME   http://*bedslime.com/*/ in body

User avatar
Calum
guru
guru
Posts: 1349
Joined: Fri Jan 10, 2003 11:32 am
Location: Bonny Scotland
Contact:

Post by Calum »

what is ham?

User avatar
Void Main
Site Admin
Site Admin
Posts: 5716
Joined: Wed Jan 08, 2003 5:24 am
Location: Tuxville, USA
Contact:

Post by Void Main »

The opposite of spam (good mail).

User avatar
Void Main
Site Admin
Site Admin
Posts: 5716
Joined: Wed Jan 08, 2003 5:24 am
Location: Tuxville, USA
Contact:

Post by Void Main »

Update again:
http://voidmain.is-a-geek.net/files/misc/voidmain.cf

Code: Select all

body VOID_GEOCITIES       /http\:\/\/.*\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://*.geocities.com/*/?* in body

body VOID_GEOYAHOO       /http\:\/\/geocities\.yahoo\.com\..*\/.*\/\?/
score VOID_GEOYAHOO      5.1
describe VOID_GEOYAHOO   http://geocities.yahoo.com.*/*/?* in body

body VOID_BEDSLIME       /http\:\/\/.*bedslime\.com\//
score VOID_BEDSLIME      5.1
describe VOID_BEDSLIME   http://*bedslime.com/ in body

body VOID_THE18       /http\:\/\/.*the1877l\.net\//
score VOID_THE18      5.1
describe VOID_THE18   http://*the1877l.net/ in body

User avatar
Void Main
Site Admin
Site Admin
Posts: 5716
Joined: Wed Jan 08, 2003 5:24 am
Location: Tuxville, USA
Contact:

Post by Void Main »

Updated again:

Code: Select all

rawbody VOID_GEOCITIES       /http\:\/\/.*\.geocities\.com\/.*\/\?/
score VOID_GEOCITIES      5.1
describe VOID_GEOCITIES   http://*.geocities.com/*/?* in body

rawbody VOID_GEOYAHOO       /http\:\/\/geocities\.yahoo\.com\..*\/.*\/\?/
score VOID_GEOYAHOO      5.1
describe VOID_GEOYAHOO   http://geocities.yahoo.com.*/*/?* in body

rawbody VOID_BEDSLIME       /http\:\/\/.*bedslime\.com\//
score VOID_BEDSLIME      5.1
describe VOID_BEDSLIME   http://*bedslime.com/ in body

rawbody VOID_THE18       /http\:\/\/.*the1877l\.net\//
score VOID_THE18      5.1
describe VOID_THE18   http://*the1877l.net/ in body

User avatar
Void Main
Site Admin
Site Admin
Posts: 5716
Joined: Wed Jan 08, 2003 5:24 am
Location: Tuxville, USA
Contact:

Post by Void Main »

Update:
http://voidmain.is-a-geek.net/files/misc/void.cf

Code: Select all

rawbody VOID_GEOCITIES       /http\:\/\/.*\.geocities\.com\/.*\//
score VOID_GEOCITIES           5.1
describe VOID_GEOCITIES       http://*.geocities.com/*/ in body

rawbody VOID_GEOYAHOO       /http\:\/\/geocities\.yahoo\.com\..*\/.*\//
score VOID_GEOYAHOO           5.1
describe VOID_GEOYAHOO       http://geocities.yahoo.com.*/*/ in body

rawbody VOID_BEDSLIME         /http\:\/\/.*bedslime\.com\//
score VOID_BEDSLIME             5.1
describe VOID_BEDSLIME         http://*bedslime.com/ in body

rawbody VOID_THE18               /http\:\/\/.*the1877l\.net\//
score VOID_THE18                   5.1
describe VOID_THE18               http://*the1877l.net/ in body

rawbody VOID_LOVE                 /http\:\/\/.*-love-.*\.us\//
score VOID_LOVE                     5.1
describe VOID_LOVE                 http://*-love-*.us/ in body

Post Reply