On Wed, 12 Sep 2007, Brian Wilson wrote:
I've somehow made it onto spam list that isn't being picked up by RBLs or by
bayes. All messages have a url that looks like this (where X's are all
digits):
http://aero-dog.com/1-23-28276-45381XXXXXXX.html
All messages are originating from 206.131.x.x and I have been submitting them
to spamcop. A sample message is here: http://bubba.org/spam/newspam1.txt
Any suggestions for detecting this? My bayes has been pretty much spot on
for months, so this has me puzzled.
The sample was older so that is probably why it is being picked up, but
the newer samples from here are not getting scored from RBL's. I
added this URI rule to pick these up:
uri FROSTY_SAVER_URI /^http\:\/\/[\S\-]+\/[\d\-]+.html/ score
FROSTY_SAVER_URI 10
I'm sure someone will complain that they have a better regex, but it's
working for me.
Brian
