Another pattern I notice is that the plain text part always has 3 lines of
random words, all lower case, no punctuation except apostrophe in the
contractions. Some have a blank line (one space) before the 3 lines of
text. Maybe we could add a low-valued body rule for that pattern?
The HTML part
On Fri, 19 Dec 2003, Aaron Everett <[EMAIL PROTECTED]> wrote:
> Subject: Re: XBHGX,7844, tales of these
Yes; in looking closer at the ones I've seen, I find one of this variant
also. It just had enough backhair that it was caught anyway. :-) Also,
my sample of that variant has more than 8 upp
tection at http://www.cloudmark.com/spamnetsig/}
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Brent J. Nordquist
Sent: Friday, December 19, 2003 12:18 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Ruleset for RND UC CHAR spam
On Fri, 19 Dec 2003, Christopher X.
On Fri, 19 Dec 2003, Christopher X. Candreva wrote:
> A Spam got through SA last night, with two things I hadn't seen before -
> Yet another form of a %RANDOM variable that isn't replaced by a value:
>
> Subject: Re: %RND_UC_CHAR[2-8], he inadvertently turned
Heh, yeah, the developer clearly sc
