[Mimedefang] How can I get this email blocked?

[Jim Crippen]

You can add something like this to your
/etc/mail/spamassassin/sa-mimedefang.cf file:


rawbody BLOCK_ME                /s%74orefr%65e%2E%62iz/i
describe BLOCK_ME               I want this blocked
score BLOCK_ME                  5.00

This will set the score to atleast 5.

You can use whatever you want in place of "s%74orefr%65e%2E%62iz" but this
is found more than once it the below email.

Hope this helps.

Jim

-----Original Message-----
From: Matt Rossiter [mailto:matt at rossiters.com]
Sent: Tuesday, March 09, 2004 1:07 PM
To: mimedefang at lists.roaringpenguin.com
Subject: [Mimedefang] How can I get this email blocked?


Hi there,

I keep getting repeated spams which contain the following html code.

<snip>

<font color=000000 size=2 face=arial>
Download your soft ware from our Superfast (100mbits connection) site &
you will be given your own exclusive registration key to register the soft
ware you bought from us, and now you have your own registered copy of soft
ware (will never expired again)<br><br>
It's <b>OEM version</b> of soft ware which is an <b>Original/Genuine soft
ware</b>, strictly no piracy soft ware 
</font>
<center>
<b><a
href=http://drs.yahoo.com/fastness/eldritchlegatary/*%68ttp://bracingdissolu
te.s%74orefr%65e%2E%62iz/0/p/
target=_blank><font color=0000FF size=5 face=arial><u>Over 850 popular
titles for you to choose from<br><br>Act quick now before all
sold<br><br>Start using your needed soft ware now<br>== C L I C K - H
E R E ==</b><br><font size=2>(Plz give 2-3 mins to complete the page
loading bcos the page has 850 titles on it)</font><br><br></u></a>
<a
href=http://drs.yahoo.com/colubertitanosaur./tophetperdition/*%68ttp://sade.
s%74orefr%65e%2E%62iz/%75n%73ub.html
target=_blank><font size=1>take me down</font></a>

</snip>


I normally have anything with a .biz URI in the message filtered
out.  This one doesn't seem to get caught.  It usally gets tagged with a
spam score of 2.5 and my tolerance is 5.0.  The link in this email takes
you to a domain called storefree.biz - can someone suggest away of
eliminating this spam?

Thanks

Matt


_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang