Re: debbie-dealz / frosty-saver / got-hyrda / aero-dog spam

On Wed, 12 Sep 2007, Brian Wilson wrote:

>
> I've somehow made it onto spam list that isn't being picked up by RBLs or by
> bayes. All messages have a url that looks like this (where X's are all
> digits):
>
> http://aero-dog.com/1-23-28276-45381XXXXXXX.html
>
> All messages are originating from 206.131.x.x and I have been submitting them
> to spamcop. A sample message is here: http://bubba.org/spam/newspam1.txt
>
> Any suggestions for detecting this? My bayes has been pretty much spot on
> for months, so this has me puzzled.
>

The sample was older so that is probably why it is being picked up, but the newer samples from here are not getting scored from RBL's. I added this URI rule to pick these up:

uri FROSTY_SAVER_URI /^http\:\/\/[\S\-]+\/[\d\-]+.html/ score FROSTY_SAVER_URI 10 I'm sure someone will complain that they have a better regex, but it's working for me.

Brian Received on Wed Sep 12 13:27:55 2007