new spam getting through

[Steve Freegard]

On 02/12/10 05:56, Jeff Mills wrote:
> Is anyone else having issues with some new very simple spam coming
> through in the last 48 hours?
>
> I’m having a lot of trouble blocking this stuff because the URL changes
> all the time as well as the text.
>
> Here is an example:
>
> http://pastebin.com/kuAH2GUY
>
> Has anyone managed to come up with anything to stop it?
>

Try my short URL decoder plug-in that I wrote for SA:

http://www.fsl.com/support/DecodeShortURLs.pm
http://www.fsl.com/support/DecodeShortURLs.cf

You'll need to add x(dot)co to the shortener list though; the other 
defaults should work fine.

Put both files in /etc/mail/spamassassin and restart MailScanner to get 
SA to start using the new plugin.

This will allow SA to 'see' the decoded URI and check it against URI 
blacklists or local 'uri' rules, so you have plenty of options to start 
blocking these.

Regards,
Steve.