Tristan Miller wrote:
Greetings.
In article <[EMAIL PROTECTED]>, Doc Schneider wrote:
[1] SARE rulesets: SARE_REDIRECT_POST300 SARE_EVILNUMBERS0
SARE_EVILNUMBERS1 SARE_EVILNUMBERS2 SARE_BAYES_POISON_NXM SARE_HTML
SARE_HEADER SARE_SPECIFIC SARE_ADULT SARE_BML SARE_FRAUD SARE_SPOOF
SARE_RANDOM SARE_SPAMCOP_TOP200 SARE_OEM SARE_GENLSUBJ SARE_HIGHRISK
SARE_UNSUB SARE_URI0 SARE_URI1 SARE_URI2 SARE_WHITELIST SARE_OBFU
Unless I'm missing seeing it you're not using SARE_STOCKS which does
catch these image type spams.
Good catch; I wasn't aware that there was now a SARE_STOCKS ruleset. I've
added it to my /etc/rulesdujour/config. Now the scores are a bit higher,
but usually not enough to put them over the spam threshold.
Regards,
Tristan
I'd recommend also having SA learn some of those spams. It helps! And
those of us in SARE are always trying to improve these pump and dumps so
the SARE_STOCKS does get updated a lot.
Can you send me offlist a couple of these spams that aren't being
caught? Zip them up to avoid my own SA. 8*)
--
-Doc
Penguins: Do it on the ice.
4:56pm up 73 days, 13:16, 18 users, load average: 0.46, 0.67, 0.64
SARE HQ http://www.rulesemporium.com/
