Mailing List Archive

On Wed, 11 Feb 2004, Dan Didier wrote:

> Anyone else getting a lot of emails from medsplanet.info? How can I add this URL to a rule?
>
> Here is an example:
>
> Suuperr Viaagraa ( also called Ciallis )
> is the new drug to leave Viaggrraaa in shadows.
> It lasts 24 hours long and works withing 15 min.
>
> You get the lowest price on the net,
> Guaranteed for as low as $3 a dose.
> Regular price: $10
>
> Try us now,
>
> http://medsplanet.info/sv/?pid=evaph3790 <http://medsplanet.info/sv/?pid=evaph3790>
>
> Greetings. EVA

Grab Chris Santerre's BigEvil rule set, it may already be in there.
If not, grab a set of lines from the above file, put them in your own
rule.cf file, change the rule's name to something different (no two
rules can have the same name), remove Chris's hosts, and drop in yours.

Pretty soon, you too will have your own local home-grown BigEvil
rule set. Mine is up to 2000 hosts. ;)

Just beware of two things:
Always lint your rules before using
Rule writing can become addictive, you too may join the no-life club. ;)

--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{

(Apologies to Dan, I screwed up again and just hit Reply instead of manually
editing the recipient list to get this back to the list. I sure wish that
some of TPTB would adjust the list so that the Reply-to: or From: headers
ALWAYS had the list id in it, rather than having it randomly in
from/to/cc/nowhere!)

Loren


I've been thinking of trying something along the line of

uri UR_A_SICK_1
/^\w*(?:meds|medz|pharm|drugs|drugz|herbalz)\w*\.(?:info|biz)/
uri UR_A_SICK_1_2 /^preferred(?:medz|drugs|rx|pharma)\.biz/

NOTE: I haven't tried these rules, so I don't know what they will do.
Perhaps give syntax errors...

Lets see, what do I have in todays' batch of meds spams...
www.firstlevelsales.com
www.getcheapdrugs.biz
www.cheapestmedz.biz
www.preferredpharma.biz
www.preferredrx.biz
nco.herbalzforcheap.com

So if those rules work they will catch all but one case.

Of course, all of them were caught as spam anyway by other rules, so I'm not
sure why more rules would be required.

Loren

----- Original Message -----
From: "Dan Didier" <dan@mapolce.com>
To: <spamassassin-users@incubator.apache.org>
Sent: Wednesday, February 11, 2004 6:35 PM
Subject: medsplanet.info


> Anyone else getting a lot of emails from medsplanet.info? How can I add
this URL to a rule?
>
> Here is an example:
>
> Suuperr Viaagraa ( also called Ciallis )
> is the new drug to leave Viaggrraaa in shadows.
> It lasts 24 hours long and works withing 15 min.
>
> You get the lowest price on the net,
> Guaranteed for as low as $3 a dose.
> Regular price: $10
>
> Try us now,
>
> http://medsplanet.info/sv/?pid=evaph3790
<http://medsplanet.info/sv/?pid=evaph3790>
>
> Greetings. EVA
>
>

Loren,

Which rules caught it? Mine get through.

Dan


-----Original Message-----
From: Loren Wilton [mailto:lwilton@earthlink.net]
Sent: Thursday, February 12, 2004 4:31 AM
To: SpamAssassin Mailing List
Subject: Re: medsplanet.info

(Apologies to Dan, I screwed up again and just hit Reply instead of
manually editing the recipient list to get this back to the list. I
sure wish that some of TPTB would adjust the list so that the Reply-to:
or From: headers ALWAYS had the list id in it, rather than having it
randomly in
from/to/cc/nowhere!)

Loren


I've been thinking of trying something along the line of

uri UR_A_SICK_1
/^\w*(?:meds|medz|pharm|drugs|drugz|herbalz)\w*\.(?:info|biz)/
uri UR_A_SICK_1_2 /^preferred(?:medz|drugs|rx|pharma)\.biz/

NOTE: I haven't tried these rules, so I don't know what they will do.
Perhaps give syntax errors...

Lets see, what do I have in todays' batch of meds spams...
www.firstlevelsales.com
www.getcheapdrugs.biz
www.cheapestmedz.biz
www.preferredpharma.biz
www.preferredrx.biz
nco.herbalzforcheap.com

So if those rules work they will catch all but one case.

Of course, all of them were caught as spam anyway by other rules, so I'm
not sure why more rules would be required.

Loren

----- Original Message -----
From: "Dan Didier" <dan@mapolce.com>
To: <spamassassin-users@incubator.apache.org>
Sent: Wednesday, February 11, 2004 6:35 PM
Subject: medsplanet.info


> Anyone else getting a lot of emails from medsplanet.info? How can I
add
this URL to a rule?
>
> Here is an example:
>
> Suuperr Viaagraa ( also called Ciallis )
> is the new drug to leave Viaggrraaa in shadows.
> It lasts 24 hours long and works withing 15 min.
>
> You get the lowest price on the net,
> Guaranteed for as low as $3 a dose.
> Regular price: $10
>
> Try us now,
>
> http://medsplanet.info/sv/?pid=evaph3790
<http://medsplanet.info/sv/?pid=evaph3790>
>
> Greetings. EVA
>
>