A sudden increase in drug spam emails

[Anthony Peacock]

Hi,

> Anthony Peacock wrote:
> > 
> > I am using the following rule, which I got from the discussions on
> > the list.
> > 
> > # Based on rules posted on users at spamassassin.apache.org
> > #
> > uri          CHIME_URL_GEOC          /\buk\.geocities\.com\b/i
> > describe CHIME_URL_GEOC          High amounts of spam from
> > Geocities. score     CHIME_URL_GEOC          1.0
> > 
> 
> With more spam from uk/it/ar/de, i now use the following as suggested
> earlier on this list.
> 
> uri  GEO_CHECK  /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i
> 
> You could also check out http://antispam.imp.ch/rules/asciispam.cf

I could, but these mails are now being caught more by Bayes and 
URIBLs that this rule doesn't really make much difference now.  It 
worked great while Bayes and the BLs caught up, but doesn't make much 
impact now.

-- 
Anthony Peacock       
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"The most exciting phrase to hear in science, the one that 
heralds new discoveries, is not 'Eureka!' 
but 'That's funny....'" -- Isaac Asimov

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!