Re: Something new to fool SURBL

2005-03-07 Thread Robert Menschel 
Hello Thomas,

Sunday, March 6, 2005, 11:12:57 AM, you wrote:

TB As received (relevant snippet):
TB a hrefthrivedhref=http://Taiwanese.com href=

TB http://pickup-card.com;pickup-card.com/a

SARE_HTML_A_INV in 70_sare_html0.cf will catch the first line of
those. Our current score for that is 3.333

Bob Menschel

Something new to fool SURBL

2005-03-06 Thread Thomas Bolioli 
As received (relevant snippet):
a hrefthrivedhref=http://Taiwanese.com href=
http://pickup-card.com;pickup-card.com/a
Now here is the SA report on it:
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on 
nova.terranovum.com
X-Spam-Level: *
X-Spam-Status: No, score=1.2 required=4.0 tests=BAYES_50,HTML_20_30,
   HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,MIME_HTML_ONLY autolearn=no
   version=3.0.0

I can post the original email in it's entirety if anyone needs it.
Tom


smime.p7s
Description: S/MIME Cryptographic Signature

Re: Something new to fool SURBL

2005-03-06 Thread Rocky Olsen 
A good rule for catching these is:

rawbody XMBSHREFv2  /(?!\ba?href=.)(?:\b\w{2,}ref=.)/i


I score it at 4.0 for our installation, granted doesn't help with the surbl
tagging, but it works well enough at catching these.

-Rocky


On Sun, Mar 06, 2005 at 02:12:57PM -0500, Thomas Bolioli wrote:
 As received (relevant snippet):
 a hrefthrivedhref=http://Taiwanese.com href=
 
 http://pickup-card.com;pickup-card.com/a
 
 Now here is the SA report on it:
 X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on 
 nova.terranovum.com
 X-Spam-Level: *
 X-Spam-Status: No, score=1.2 required=4.0 tests=BAYES_50,HTML_20_30,
HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,MIME_HTML_ONLY autolearn=no
version=3.0.0
 
 I can post the original email in it's entirety if anyone needs it.
 Tom
 



-- 
__


what's with today, today?

Email:  [EMAIL PROTECTED]
PGP:http://rocky.mindphone.org/rocky_mindphone.org.gpg


signature.asc
Description: Digital signature