Karsten Bräckelmann-2 wrote: > > Yes, it is indeed likely prone to FPs on its own, unless very strictly > meta'ed for some special cases, and it actually also is likely bound to > expire soon. Obfuscation techniques like this usually are subject to > change, quite rapidly, and I'd bet you'll soon find yourself playing > whack-a-mole. > You are correct about FPs on its own, that is why I meta'ed the ruleset with the existence of a URL to these portal providers. And you are correct about obfuscation techniques: the amount of changes is fairly high, but slow enough to be helpful in fighting it. And to prevent the whack-a-mole battle I lined up rulesets for a fair amount of expectable crap. Here's a recent change:
Aug 29 21:46:24 mail filter[22469]: n7TJkJ03026851: Spamassassin found from <hosmanzmjmcyhroytxc1...@hotmail.com> at blu0-omc3-s14.blu0.hotmail.com [65.55.116.89] HELO blu0-omc3-s14.blu0.hotmail.com to <victim> hits: 10.168, names: FREEMAIL_FROM,PORTAL_ABUSE,HTML_MESSAGE Subject: Seeixy brunette fu-icks and suuicks on camera -- View this message in context: http://www.nabble.com/Porn-portal-spammers-tp25203019p25205909.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
