-----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] Sent: Friday, September 10, 2004 8:48 PM To: discuss@lists.surbl.org Subject: [SURBL-Discuss] important reduce wrise renkles & skin spots (fwd)
Hi!
Our favorite pill spammers also try to get around SURBL now.
I dont want to end up making SA rulesets for this, any suggestions ?
ns3.airmaramba.biz ns3.avk29.biz
The same crap... But, with less SA hits now, since its not touched by SURBL. Bah.
---------- Forwarded message ---------- Date: Sat, 11 Sep 2004 01:50:29 +0100 From: kenneth clakley auroraschorn@rfc.every1.net To: wilfredo moote reyes@prolocation.net Subject: important reduce wrise renkles & skin spots
suc-oneonta sony-steo lettery
From inside to outside, from w^eig_ht l`o^ss to skin care. From mental
relief to physical relief, from antidepressant to muscle relaxant. The care inside out.
you can copy
wjq.s.adjuster6370pinn.com/56/
to your browser
I wrote this for SARE:
uri ANUMA /.[a-z]{4,}\d{4,}[a-z]{4,}.(?:com|net|biz|info|org)/i describe ANUMA Domain with ALPHAs NUMBERs APLHAs score ANUMA 1.0
to catch tons of this: stiffed5912tads.com unawares6248pinn.com snoozed2548rneds.com 585paperwork970tads.com congener1455rneds.com
--Chris
Hi Chris,
uri ANUMA /.[a-z]{4,}\d{4,}[a-z]{4,}.(?:com|net|biz|info|org)/i describe ANUMA Domain with ALPHAs NUMBERs APLHAs score ANUMA 1.0
to catch tons of this: stiffed5912tads.com unawares6248pinn.com snoozed2548rneds.com 585paperwork970tads.com congener1455rneds.com
Cant you make a more specific one, with much higher scores? Those domains all end with tads, pinn, pi11, pill, rneds, pirrs, drygs, tabs or drugs
Dont forget the .us ones, they use those a lot also.
Bye, Raymond.
on Tue, Sep 14, 2004 at 11:42:10PM +0200, Raymond Dijkxhoorn wrote:
Hi Chris,
uri ANUMA /.[a-z]{4,}\d{4,}[a-z]{4,}.(?:com|net|biz|info|org)/i describe ANUMA Domain with ALPHAs NUMBERs APLHAs score ANUMA 1.0
to catch tons of this: stiffed5912tads.com unawares6248pinn.com snoozed2548rneds.com 585paperwork970tads.com congener1455rneds.com
Cant you make a more specific one, with much higher scores? Those domains all end with tads, pinn, pi11, pill, rneds, pirrs, drygs, tabs or drugs
Dont forget the .us ones, they use those a lot also.
Yep. And the pat above caught
global2000hosting.net serenajones2000netscape.net optin9987free.net
from my current local domains bl, for example. I'd suggest maybe something like:
(advantage|aslkj|azaeif|chick|cslt|csltsite|daze|dazeey|dazy|ddrugs|djie|dozy|drug|drugs|drugsed|drugss|drugz|dryg|drygs|ensim|expo|ezine|foryou|free|group|here|hosting|hspeedm|info|jdao|jekn|jkhn|jkla|jvao|kjlas|laei|leads|library|link|meddds|medications|meds|medser|nbme|nets|netscape|nkle|online|pill|pillllls|pillls|pills|pillys|pillyss|pinn|pirrs|pjtv|pretz|promo|psychic|publishers|rneds|send|sendtrip|serve|soft|store|street|studio|tabbbs|tabbs|tablets|tabs|tads|today)\d{4,}.(biz|com|info|net|us)/i
Or contract the first pat down using the >2 suffixes here:
83 pills 73 drugs 70 meds 67 tabs 51 pill 36 drug 23 tads 22 dryg 21 drygs 19 rneds 15 studio 14 pinn 12 pirrs 12 medications 4 tabbs 4 send 4 cslt 3 here 2 tabbbs 2 street 2 pillys 2 hosting 2 drugz
-
Chris Santerre -
Raymond Dijkxhoorn -
Steven Champeon