OT: SA 3.0.2 add on rules.

[Martin Hepworth]

Mike

lots of the SARE rules, .. oh here's the listing..

70_sare_adult.cf                88_FVGT_uri.cf
70_sare_bayes_poison_nxm.cf     99_FVGT_Tripwire.cf
70_sare_genlsubj.cf             99_FVGT_meta.cf
70_sare_header.cf               99_sare_fraud_post25x.cf
70_sare_html.cf
70_sare_oem.cf                  backhair.cf
70_sare_random.cf               bogus-virus-warnings.cf
70_sare_specific.cf             chickenpox.cf
70_sare_spoof.cf                evilnumbers.cf
70_sare_unsub.cf
70_sare_uri.cf
72_sare_bml_post25x.cf          mangled.cf
72_sare_redirect_post3.0.0.cf   random.cf
88_FVGT_body.cf
88_FVGT_headers.cf              tripwire.cf
88_FVGT_rawbody.cf              weeds.cf
88_FVGT_subject.cf


In my local.cf I've got lots of osbufacted rules from..
http://sandgnat.com/cmos/cmos.jsp

and some pre generated ones from....

http://tinyurl.com/3rrrl        ("obfuscated only" wordlist for words
like mortgage)
http://tinyurl.com/4wmzt     (badwords wordlist)

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Mike Tremaine wrote:
> Just wondering what other sets [IE SARE, etc] people are using with SA
> 3+ [3.0.2]. I upgraded most of the mail servers I control last month
> from 2.6 to 3.0.2 and removed all the extra .cf files I had installed
> just to see how it was out of the box.
>
> Other then Stock Picking spam and some Pill ads it seems to be pretty
> good. But I think it is time to add some extra rules again.
>
> Thanks,
>
> --
> Mike Tremaine
> mgt at stellarcore.net
> http://www.stellarcore.net
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!