gain,
John McGivern
-Original Message-
From: Chris Santerre [mailto:[EMAIL PROTECTED]
Sent: August 20, 2003 4:06 PM
To: John McGivern; Robert Menschel
Cc: [EMAIL PROTECTED]
Subject: RE: [SAtalk] catching the Banned CD spam!
COuld it possible be the double base64 text trick again? Those tend
ilto:[EMAIL PROTECTED]
> Sent: Wednesday, August 20, 2003 9:08 AM
> To: Robert Menschel
> Cc: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] catching the Banned CD spam!
>
>
> Hey everyone! Thanks for all the responses! I was out of
> the office yesterday.
>
> I do have
At 8/20/03 09:28 AM , Sandy S wrote:
I'm no expert so I may be off-base here, but shouldn't the rule have ()?
body RULE_NAME /(bannedc|banned c)/i
I think that without them you're scanning for one of the following strings:
"bannedcanned c" or "bannedbanned c".
And personally, I'd just do:
body RULE
From: "John McGivern" <[EMAIL PROTECTED]>
To: "Robert Menschel" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Wednesday, August 20, 2003 8:07 AM
Subject: RE: [SAtalk] catching the Banned CD spam!
> Hey everyone! Thanks for all the responses! I was o
Sent: August 18, 2003 10:09 PM
To: John McGivern
Cc: [EMAIL PROTECTED]
Subject: Re: [SAtalk] catching the Banned CD spam!
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello John,
I find the following rules work well for me:
header RM_sp_BannedCD Subject =~ /b\s?a\s?n\s?n\s?e\s?d\s?c\s
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello John,
I find the following rules work well for me:
header RM_sp_BannedCD Subject =~ /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i
describe RM_sp_BannedCD Subject mentions the supposedly banned CD
scoreRM_sp_BannedCD 1.21 # 21 spam, 0 ham, Aug 12
At 8/18/03 02:07 PM , Rich Puhek wrote:
body BANNED_CD /banned c/
will not match "Banned CD", but
body BANNED_CD /banned c/i
will match it.
Even better might be: /banned\s*c\s*d/i
I'd *definitely* go with the latter, because either of the first two rules
will also catch things like:
the
On Mon, 2003-08-18 at 22:07, Rich Puhek wrote:
> John McGivern wrote:
> > Hi everyone,
> >
> > I don't know if you guys get the SPAM that advertises the "Banned CD" I get
> > dozens of them. Anyway, I've added a body rule looking for the term "bannedc" or
> > "banned c" and yet it still doesn'
John McGivern wrote:
Hi everyone,
I don't know if you guys get the SPAM that advertises the "Banned CD" I get dozens of them. Anyway, I've added a body rule looking for the term "bannedc" or "banned c" and yet it still doesn't catch it eventhough the text is right there! I know the rule is wo
At 03:44 PM 8/18/2003 -0400, John McGivern wrote:
I don't know if you guys get the SPAM that advertises the "Banned CD" I
get dozens of them. Anyway, I've added a body rule looking for the term
"bannedc" or "banned c" and yet it still doesn't catch it eventhough the
text is right there! I kno
At Mon Aug 18 20:44:24 2003, John McGivern wrote: [reformatted]
> I don't know if you guys get the SPAM that advertises the "Banned
> CD" I get dozens of them. Anyway, I've added a body rule looking
> for the term "bannedc" or "banned c" and yet it still doesn't catch
> it eventhough the text is
John McGivern wrote:
Hi everyone,
I don't know if you guys get the SPAM that advertises the "Banned CD"
I get dozens of them.
I get 7-9 per week, but SA has been catching each & every one of them.
Have you fed them through sa-learn, by chance?
-Jonathan
--
What's the rule you've written?
On Mon, Aug 18, 2003 at 03:44:24PM -0400, John McGivern is rumored to have said:
>
> Hi everyone,
>
> I don't know if you guys get the SPAM that advertises the
> "Banned CD" I get dozens of them. Anyway, I've added a body rule ...
--
"Men and nations behave
13 matches
Mail list logo
