Re: [SAtalk] Some more rule ideas

2002-03-14 Thread Jim Paris
> >The \d's there are unnecessary, as \w includes digits. That means a > >character class is not needed, so the regex simplifies to > > > > rawbody UNIQUE_BODY_ID/^(?:(?:\w{7,}-)+)\w{7,}$/ > > > >Greg > > This strikes me as a bad rule. It matches any hyphenated English phrase >

Re: [SAtalk] Some more rule ideas

2002-03-14 Thread Rob McMillin
Greg Ward wrote: >On 13 March 2002, Kerry Nice said: > >>Very cool. But it only worked when I changed it from body to rawbody. >>I assume that is because it is at the very end of the message. >> >>rawbody UNIQUE_BODY_ID/^(?:(?:[\w\d]{7,}-)+)[\w\d]{7,}$/ >> >

Re: [SAtalk] Some more rule ideas

2002-03-14 Thread Greg Ward
On 13 March 2002, Kerry Nice said: > Very cool. But it only worked when I changed it from body to rawbody. > I assume that is because it is at the very end of the message. > > rawbody UNIQUE_BODY_ID/^(?:(?:[\w\d]{7,}-)+)[\w\d]{7,}$/ ^^

Re: [SAtalk] Some more rule ideas

2002-03-14 Thread Kerry Nice
Very cool. But it only worked when I changed it from body to rawbody. I assume that is because it is at the very end of the message. rawbody UNIQUE_BODY_ID/^(?:(?:[\w\d]{7,}-)+)[\w\d]{7,}$/ describe UNIQUE_BODY_IDString in body which acts as unique ID score UNIQUE_BODY_ID

Re: [SAtalk] Some more rule ideas

2002-03-13 Thread Matthew Cline
On Tuesday 12 March 2002 09:03 am, Kerry Nice wrote: > Would it be possible to come up with a rule for those > random things that are the final lines of a lot of > spams? These are the kind of things that break razor, > since the hash is different. > > I cut some samples out of some recent spams:

[SAtalk] Some more rule ideas

2002-03-12 Thread Kerry Nice
Would it be possible to come up with a rule for those random things that are the final lines of a lot of spams? These are the kind of things that break razor, since the hash is different. I cut some samples out of some recent spams: 2720IGVV3-313KAAA5557ymez4-032l28 2968HyRF6-424hl13 7347ZCuj5-