ONLY use antidrug if you are stuck on SA 2.6x for some reason.
Created by: Tim Jackson with contributions from others Contact: TBD License Type: TBD Status: Active Auto-update: Yes Available at: information on Tim's rules: Main aim is to catch warnings generated by virus scanners along the lines of "you sent us virus", which are sent to the (usually faked) 'senders' of virus-infected e-mails.
Contains many "black-and-white" very-high-scoring rules. Sample Results: Masscheck Bogus Virus (version 1.69 2004-03-04) chickenpox is a set of rules designed to catch spam like "f|or kind of garb age" Created by: Jennifer Wheeler Contact: TBD License Type: TBD Status: Locked Auto-update: No Available at: NOTE: Early versions of Rules Du Jour included this set in its default config.
Keep learning them through bayes is about all I can suggest. The amount of spam emanating from hotmail is getting ridiculous lately.
If you're a small server you could possibly penalize all mail from hotmail and then whitelist known good senders for your clients but that's getting a bit extreme.
Created by: Matt Yackley Contact: [email protected] Type: Artistic Status: Active Auto-update: Yes - Please try to keep checks down to no more then once every 24 hours Available at: Localized language packs available at the link below.
Mirror: More information on Matt Yackley's rules: Sample Results: Masscheck Evil Numbers (Version: 1.12k 03/31/2004) Malware Block List The Malware Block List is a free, automated and user contributed system for checking URLs for the presence of Viruses, Trojans, Worms, or any other software considered Malware.
Please do not use auto-update scripts More information on Jennifer's rules: Results: Masscheck Chickenpox (Version 1.15 2004-02-06) Chickenpox rules are BROKEN for non-English text, they treat all accented characters as non-letters!
evilnumbers is a collection of phone numbers, PO boxes and street addresses harvested from spam.
Please do not use auto-update scripts Note: This is a fairly aggressive ruleset that can hit on UUencoded attachments...