A sudden increase in drug spam emails

[Anthony Peacock]

Hi,

> Anthony Peacock wrote:
> > Hi,
> >>>I am using the following rule, which I got from the discussions on
> >>>the list.
> >>>
> >>># Based on rules posted on users at spamassassin.apache.org
> >>>#
> >>>uri          CHIME_URL_GEOC          /\buk\.geocities\.com\b/i
> >>>describe CHIME_URL_GEOC          High amounts of spam from
> >>>Geocities. score     CHIME_URL_GEOC          1.0
> >>>
> >>
> >>With more spam from uk/it/ar/de, i now use the following as
> >>suggested earlier on this list.
> >>
> >>uri  GEO_CHECK  /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i
> >>
> >>You could also check out http://antispam.imp.ch/rules/asciispam.cf
> > 
> > I could, but these mails are now being caught more by Bayes and
> > URIBLs that this rule doesn't really make much difference now.  It
> > worked great while Bayes and the BLs caught up, but doesn't make
> > much impact now.
> > 
> 
> Apologies, i meant to communicate this to the OP.

No apologies necessary.  It is useful to explore the various 
flavours, I think the best advice for the OP (which others have given 
as well) is to check out the SpamAssassin users list archive, as this 
has all the rules and discussions about the pros and cons for them.

The basic rule that I used worked well for my site, until Bayes and 
URIBLs caught up.  and we didn't get any of the non-uk variety 
getting through, so I didn't 'upgrade' my version of the rule.  In 
fact I suspect I could stop using it now and not notice any drop in 
quality of filtering.

-- 
Anthony Peacock       
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"Whoever said nothing is impossible never tried slamming a 
revolving door." - Melissa O'Brien

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!