Yes, that was his rule, I forgot to mention it in my reply :)
Ruben
> -Mensaje original-
> De: Loren Wilton [mailto:[EMAIL PROTECTED]
> Enviado el: viernes, 10 de febrero de 2006 22:00
> Para: users@spamassassin.apache.org
> Asunto: Re: Little custom rule
>
> &g
> Was it you who posted this rule? Sorry if yes and I mentioned Loren's
name.
>
> Would not it be
> ALL =~ /\nTo: ([EMAIL PROTECTED]).+\nSubject:\s*Fw: (?:|hello|hey)*\1\b/i
>
> Please notice the first |, this would fall for "no word" between Fw: and
> recipient name.
It was my rule, Ruben ju
nk you for your help.
Irina
- Original Message -
From: "Ruben Cardenal" <[EMAIL PROTECTED]>
To:
Sent: Friday, February 10, 2006 10:55 AM
Subject: RE: Little custom rule
> Hi,
>
> You just need to modify a bit the regexp:
>
> ALL
a [mailto:[EMAIL PROTECTED]
> Enviado el: viernes, 10 de febrero de 2006 16:30
> Para: Loren Wilton; users@spamassassin.apache.org
> Asunto: Re: Little custom rule
>
> Hello Loren,
>
> First thank you for this rule - it helped a lot with catching this kind of
> spam.
&g
t;[EMAIL PROTECTED]>
To: "Ruben Cardenal" <[EMAIL PROTECTED]>;
Sent: Monday, February 06, 2006 3:52 PM
Subject: RE: Little custom rule
> >It seems it doesn't want to work, it just didn't match this:
> >
> >From: "rkfexklqc" <[EMAIL PROTE
That one works! Thanks :)
Ruben
> -Mensaje original-
> De: Loren Wilton [mailto:[EMAIL PROTECTED]
> Enviado el: lunes, 06 de febrero de 2006 21:52
> Para: Ruben Cardenal; users@spamassassin.apache.org
> Asunto: RE: Little custom rule
>
> >It seems it doesn
>It seems it doesn't want to work, it just didn't match this:
>
>From: "rkfexklqc" <[EMAIL PROTECTED]>
>To: [EMAIL PROTECTED]
>Subject: Fw: oscarbru
Ah, ok. As I said, it would match names in <> characters, and not one of the
dozen or so other valid formats. You have one of those other formats.
febrero de 2006 21:14
> Para: Ruben Cardenal; users@spamassassin.apache.org
> Asunto: RE: Little custom rule
>
> > I added them and had to change the 1st "{" in the 1st rule for a "(" in
>
> Hum, yes. That should have been a left parend.
>
> >order
> I added them and had to change the 1st "{" in the 1st rule for a "(" in
Hum, yes. That should have been a left parend.
>order spamd not to complain about it. Anyway, it doesn't work :(
Could try /is instead of just /i on the end of the regexes, that might help.
The trouble is this sort of r
lunes, 06 de febrero de 2006 1:23
> Para: users@spamassassin.apache.org
> Asunto: Re: Little custom rule
>
> > header __LW_BLAH1ALL =~
> /\nTo:[^<\n]+<[EMAIL PROTECTED])[^\n]+.*\nSubject:\s*Fw:
> > \1\b/i
> > header __LW_BLAH2ALL =~ /\nSubject:\s*Fw:
he.org
> Asunto: Re: Little custom rule
>
> > mainly composed by an image and its subject is always "FW: blah" where
> > "blah" is the destination account. This is, if the mail is sent to
> > [EMAIL PROTECTED] the subject is always "Fw: john"
&g
Yeah, all of them match the HTML_IMAGE_ONLY_12 rule, but not the rest of
them. As an initial measure I raised the score for that rule, but I
understand that's not the solution.
Ruben
> These are caught quite easily on my home system:
>
> Content analysis details: (42.1 points, 5.0 required)
>
> header __LW_BLAH1ALL =~ /\nTo:[^<\n]+<[EMAIL
> PROTECTED])[^\n]+.*\nSubject:\s*Fw:
> \1\b/i
> header __LW_BLAH2ALL =~ /\nSubject:\s*Fw:
> (\w+)[^\n]*.*\nTo:[^<\n]+<\1\@/i
> metaLW_BLAH__LW_BLAH1 || __LW_BLAH2
> scoreLW_BLAH1
I see those lines wrapped. The first 4 lines
> mainly composed by an image and its subject is always "FW: blah" where
> "blah" is the destination account. This is, if the mail is sent to
> [EMAIL PROTECTED] the subject is always "Fw: john"
>
> Can that be matched by a rule?
Depends. Does the "to" also have the username of the account? If
On Sunday 05 February 2006 2:25 pm, Ruben Cardenal wrote:
> Hi,
>
> In one of my servers (7200 accounts) I'm receiving tons of a spam that
> is mainly composed by an image and its subject is always "FW: blah" where
> "blah" is the destination account. This is, if the mail is sent to
> [EMAIL PROT
Hi,
In one of my servers (7200 accounts) I'm receiving tons of a spam that is
mainly composed by an image and its subject is always "FW: blah" where
"blah" is the destination account. This is, if the mail is sent to
[EMAIL PROTECTED] the subject is always "Fw: john"
Can that be matched by a r
16 matches
Mail list logo
