I received one of those "Investor Spec Sheet" spams that managed to score
virtually nothing, so here are some slight corrections to rules that would have
helped:
OLD EXCUSE_16:
body EXCUSE_16 /received this (?:e?-?mail|message) in
error[, ]* or/
describe EXCUSE_16 I wonder how many emails they sent in error...
NEW EXCUSE_16:
body EXCUSE_16 /received this.{1,10}in error[, ]* or/
This just looks for 1-10 characters between "received this" and "in error". The
message I received today simply said "If you received this in error".
OLD EXCUSE_14:
body EXCUSE_14 /you do not wish to receive further /i
describe EXCUSE_14 Tells you how to stop further SPAM
NEW EXCUSE_14:
body EXCUSE_14 /(?:you do not|no longer) wish to receive
(?:further|mail) /i
This accounts for the variation "you no longer wish to receive mail" - it could
just as easily be a separate rule but they are similar.
Also, assuming I'm not the only one who receives these "Investor spec sheet"
spams regularly, perhaps a rule for them?
body INVESTOR_SPEC_SHEET /Investor Spec Sheet/i
--
michael moncur mgm at starlingtech.com http://www.starlingtech.com/
"There is no safety in numbers, or in anything else." -- James Thurber
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
