Coming home for some minutes I saw, I am hit by 23.000 spams in my inbox from today...
The rule:
body AE_MEDS35
/\bwww(?:\s\W?\s?|\W\s)\w{3,6}\d{2,6}(?:\s\W?\s?|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
describe AE_MEDS35 obfuscated domain seen in spam
score AE_MEDS35 6.00
doea not work on the following mail:
----8<------------------------------------------------------------------
<snip>
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
samba3.private.tamay-dogan.net
X-Spam-Level: *
X-Spam-Status: No, score=1.6 required=4.5 tests=BAYES_50,RCVD_IN_NJABL_PROXY
autolearn=no version=3.2.3
<snip>
To: xml-c...@packages.debian.org
Date: Thu, 02 Jul 2009 21:34:54 -0100
Message-ID: <292648833c6120090702213...@bi11i.com>
From: Jessi <hatt...@nhylandsumc.org>
Subject: Doo You Make These 44 Mistakes in sex?
Doo You Maake These 4 Mistakes in sex? www. gen65. net. Police: Dancers Shot
With Paintbrall Guns In Boynton Baech Strip Club
----8<------------------------------------------------------------------
--
Linux-User #280138 with the Linux Counter, http://counter.li.org/
##################### Debian GNU/Linux Consultant #####################
<http://www.tamay-dogan.net/> Michelle Konzack
<http://www.can4linux.org/> c/o Vertriebsp. KabelBW
<http://www.flexray4linux.org/> Blumenstrasse 2
Jabber linux4miche...@jabber.ccc.de 77694 Kehl/Germany
IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947
ICQ #328449886 Tel. FR: +33 6 61925193
signature.pgp
Description: Digital signature
