Santos a écrit : > I have this custom rule on /etc/mail/spamassassin/local.cf > > uri GEOCITIES > /^http:\/\/(uk|it|de|sg|ar|jp|in|es|au|ca|www)\.geocities\.com\/.*\/\?/i > describe GEOCITIES Tons of spam with Geocities URL > score GEOCITIES 4.0 > > > However it simply doesn't work. Geocities spam, still enters my mailbox. > SA headers show nothing about this URI test. Someone recomended this > rule to stop geo spam, i just added the other country sub-domains. > > Am i missing something?
Geo-spammers seem to adapt.. other patterns are http://..../foo_bar/... http://..../foo12345bar67789/... i.e. the login part is \w{1,10}_\w{1,10} or \w{1,10}\d{1,5}\w{1,10}\d{1,5} There are other forms with no slash after the login part, and which don't match the above. PS. A lot use a forged helo and come from "far away" places. so you could do a META rule. FYI. the URLs below may help. -------------- message posted to the surbl ML by Eric Montréal Hi, Looks like, after months ignoring the problem, a miracle finally happened at Yahoo / Geocities tonight ... Yesterday, my list of alive Geocities spammy sites was more than 350 names long. Tonight it's down to ... 14 Geocities sites ! All others have been shutdown http://nospam.mailpeers.net/alive_spammy.txt Just for fun, here is the RIP list: http://nospam.mailpeers.net/rip_spammy.txt Could you guys verify that the sites marked as 'Closed' in the ruleset are 403/404 from your location too ? http://nospam.mailpeers.net/subevil.cf Here is a one liner bash command line script to check them all (don't worry, wget in spider mode downloads nothing) : wget http://nospam.mailpeers.net/rip_spammy.txt -Orip.txt;for i in $(egrep -i '^http:[0-9a-z\/_\-\.]*\bgeocities\b[0-9a-z\/_\-\.]*$'<rip.txt);do echo -n "$i - ";wget -T3 -t3 -w3 --spider -U"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" $i 2>&1|grep 'awaiting'|cut -d'.' -f4|cut -d' ' -f2-;done;rm -f rip.txt Are they all 403 or 404 ? Would be too bad if they ... just banned my spider! (I connected from 3 different places, got the same results) Anyways, keep sending those spammy URLs to [EMAIL PROTECTED] , but it seems like someone at Yahoo finally decided to act before being caught in a fine Spamassassin plugin or some ugly wget loops ... Let's see if that was a one time action or if they'll keep cleaning the mess until the spammers move out of their servers and back to places where SURBL will be able to toast them ... Waiting for your feedback, as usual ;-) Eric. ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_idv37&alloc_id865&op=click _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
