Very cool.  But it only worked when I changed it from body to rawbody. 
I assume that is because it is at the very end of the message.

rawbody  UNIQUE_BODY_ID        /^(?:(?:[\w\d]{7,}-)+)[\w\d]{7,}$/
describe UNIQUE_BODY_ID        String in body which acts as unique ID
score UNIQUE_BODY_ID           1.0

I did come up with 2 false hits in searching though a number of years 
worth of mail.  Not bad I guess.

/home/nice/mail/Kim-sent:Pacificare-Colorado
/home/nice/mail/journals:UofTexas-Arlington

My regular expression knowledge is kind of sad, is there a way to 
require it to have at least one digit in it?  Otherwise, I could 
certainly live with this in my personal rules.

Kerry.


Matthew Cline wrote:
> On Tuesday 12 March 2002 09:03 am, Kerry Nice wrote:
> 
>>Would it be possible to come up with a rule for those
>>random things that are the final lines of a lot of
>>spams?  These are the kind of things that break razor,
>>since the hash is different.
>>
>>I cut some samples out of some recent spams:
>>
>>2720IGVV3-313KAAA5557ymez4-032l28
>>2968HyRF6-424hl13
>>7347ZCuj5-778Tacj7769jcrJ5-644fJl30
>>7027pnJT5-732RyJK3563YhXs7-879RJlg2415DElH2-878NnAY7643XEFD0-480URWj343=
> 
> 1hJF
> 
>>J9-205ztl78
>>[6359MQMK5-455yLeL8198UCEz2-647MOlg6683VJyf3-985FWpt5691AFwW7-021KXlB78=
> 
> 86ay
> 
>>MX8-@73] 95491
>>3235
>>5761XAUy8-724HnxY5860hloK1-665PwXu4065pvLd9-368yqwh1810HDwl55
> 
> 
> This rule should catch all of them, except for the two which are just=20
> numbers, and the one that has the "@" sign and the square brackets:
> 
> body     UNIQUE_BODY_ID        /^(?:(?:[\w\d]{7,}-)+)[\w\d]{7,}$/
> describe UNIQUE_BODY_ID        String in body which acts as unique ID
> 


_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to