> That's not equivalent. Note the placement of the carat WRT the first > alternation in the original rule. It should be: > > /(?:^\s*|\s+)\[?(?:ADV|cc)[:\]]/i
Wouldn't \b work as a substitute for the (?:^\s*|\s+)? or am I confused? > I don't think the cc: has anything to do with advert codes? How often do > you see [cc] ? I suspect that should be a separate rule. As far as I can tell cc: is used exclusively by qves.com/MonsterCrush, a major source of "affiliate spam" and the bane of my existence. It doesn't appear on even all of their spams and probably won't last long, so perhaps it should be a separate rule or left out entirely. The cc: is always at the beginning of the subject and never uses brackets, so this would work: header CC_SUBJECT Subject =~ /^\s*cc:/ describe CC_SUBJECT Subject begins with cc: In case anyone wants them, I use three additional rules to catch qves.com spam. Virtually all of their messages match all three of the following: uri QVES_COM /www\.qves\.com/i describe QVES_COM qves.com: Frequent SPAM content score QVES_COM 3.0 body YOUR_PRIVACY /We are committed to respecting your privacy/ describe YOUR_PRIVACY Frequent spam privacy disclaimer score YOUR_PRIVACY 3.0 body LEAVE_SUBJECT /LEAVE in the subject line/ describe LEAVE_SUBJECT Spam unsubscribe (LEAVE) score LEAVE_SUBJECT 2.5 I don't recommend them for SA in general since they're only matched by one spammer who are bound to change their name (again) before too long. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "You live and learn. At any rate, you live." -- Douglas Adams _______________________________________________________________ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
