block newletter type spam with long url
This shows a real spam collected in a user quarantine. This shows the headers of the messages with the X-MailCleaner anti spam tags and filtering process
Received: by mailcleaner.example.net stage2 with id 1X9pQu-00074Q-4U
for <john.doe@example.net>; Wed, 23 Jul 2014 07:49:44 +0200
Received: from hermes.apache.org ([140.211.11.3] helo=mail.apache.org)
by mailcleaner.example.net stage1 with smtp
(Exim MailCleaner)
id 1X9pQt-00073j-39
for <john.doe@example.net>
from <users-return-104142-john.doe=example.net@spamassassin.apache.org>; Wed, 23 Jul 2014 07:49:43 +0200
Received: (qmail 82580 invoked by uid 500); 23 Jul 2014 05:48:24 -0000
X-MailCleaner-SPF: pass
Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
list-help: <mailto:users-help@spamassassin.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@spamassassin.apache.org>
List-Post: <mailto:users@spamassassin.apache.org>
List-Id: <users.spamassassin.apache.org>
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 82569 invoked by uid 99); 23 Jul 2014 05:48:24 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 23 Jul 2014 05:48:24 +0000
X-ASF-Spam-Status: No, hits=8.3 required=10.0
tests=HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,MISSING_MID,MISSING_MIMEOLE,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (athena.apache.org: local policy)
Received: from [103.241.181.138] (HELO 24x7server.net) (103.241.181.138)
by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 23 Jul 2014 05:48:19 +0000
Received: from ([120.61.18.26]) by 24x7server.net with MailEnable WebMail; Wed, 23 Jul 2014 11:12:03 +0530
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--=_Part_8FD36DABE4C04C758A86432487F049CC"
To: <users@spamassassin.apache.org>
From: "Rajesh M." <24x7server@24x7server.net>
Subject: block newletter type spam with long url
Date: Wed, 23 Jul 2014 11:12:03 +0530
X-Priority: 3
X-MSMail-Priority: Medium
X-ME-Bayesian: 0.000000
X-Virus-Checked: Checked by ClamAV on apache.org
Message-Id: <20140723054823.CB51F6A1@athena.apache.org>
X-Commtouch-ctIPd-RefID: tid=0001.0A0C0301.53CF47BB.0069
X-Commtouch-ctasd-RefID: str=0001.0A0C0207.53CF4CF8.01E6:SCGSTAT1067355,ss=1,re=-4.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=1024
X-Commtouch: is not spam (Spam: Unknown, VOD: Medium)
X-NiceBayes: is not spam (54%)
X-Spamc: is spam (5.6/5.0)
X-MailCleaner-Information: Please contact support@example.net for more information
X-MailCleaner-ID: 1X9pQu-00074Q-4U
X-MailCleaner: Found to be clean
X-MailCleaner-SpamCheck: spam, Spamc (score=5.6, required=5.0,
MIME_HTML_ONLY 1.1, MISSING_MIMEOLE 1.8, DCC_CHECK 2.0,
HTML_MESSAGE 0.0, HTML_MIME_NO_HTML_TAG 0.6)
X-Auto-Response-Suppress: DR, NDR, RN, NRN, OOF, AutoReply
This is a multi-part message in MIME format.
----=_Part_8FD36DABE4C04C758A86432487F049CC
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
hi<br><br>we are getting spam with long url links to external websites. som=
e times the links are hundreds of characters long.<br><br>few examples g=
iven below<br><br>is there any rule to block these =3F<br><br>basically =
i need to block any url which contains several alphanumeric characters a=
t the end.<br><br>http://xxxxx.com/uquote/b7e7c7f955d9af8c5ef=3Da5d66e_a=
4404d9<br>http://www.xxxx.us/l/lt1N2743MF255X/719V2211P5437V161<br><br><=
br>thank you,<br><br>rajesh<br><br><br>
----=_Part_8FD36DABE4C04C758A86432487F049CC--
