Hello, because I am currently hit by several 10.000 new type of spam using domains like www.(meds|pill|shop)XX.(net|com|org) I sugest you to put the following in your spamassassin config:
----[ '~/.spamassassin/user_prefs' ]------------------------------------
body AE_MEDS35
/\(\s?w{2,4}\s(?:meds|pill|shop)\d{1,4}\s(?:net|com|org)\s?\)/
describe AE_MEDS35 obfuscated domain seen in spam
score AE_MEDS35 3.00
------------------------------------------------------------------------
Works perfectly and has today catched over 63.000 spams on my server.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
Systemadministrator
25.9V Electronic Engineer
Tamay Dogan Network
Debian GNU/Linux Consultant
--
Linux-User #280138 with the Linux Counter, http://counter.li.org/
##################### Debian GNU/Linux Consultant #####################
<http://www.tamay-dogan.net/> Michelle Konzack
<http://www.can4linux.org/> c/o Vertriebsp. KabelBW
<http://www.flexray4linux.org/> Blumenstrasse 2
Jabber linux4miche...@jabber.ccc.de 77694 Kehl/Germany
IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947
ICQ #328449886 Tel. FR: +33 6 61925193
signature.pgp
Description: Digital signature
