Wouldn't you be better off using a URI test rather than RAWBODY?
At 08:06 PM 2/10/2003 -0500, Matt Kettler wrote:
Although I'll warn you that such a rule is also likely to fire off on a
lot of nonspam mail, as this is common in a LOT of URLs using scripting,
the rule you desire would be something like this:
rawbody FALSEPOSPRONE_URL_WITH_EQUALS /http\:\/\/{.1,100}=/
score FALSEPOSPRONE_URL_WITH_EQUALS 10.0
This will look for http:// with an = character within 100 chars. Not
perfect as it will match stuff outside a URL that's just past it, but then
again, a perfect one will also false pos like crazy.
For example, every bugzilla bug on the sadev list will hit it with things
like this in them:
http://www.hughes-family.org/bugzilla/show_bug.cgi?id=678
and the headers of every message to this list contains:
http://sourceforge.net/mailarchive/forum.php?forum=spamassassin-talk
Which won't match, but is an example of just how common equals signs are
in URLS.
At 10:52 AM 2/9/2003 -0600, Mike Watson wrote:
I've just started using SpamAssassin. I started because of one time of
spam that keeps eluding my Sendmail rules.
The spam usually contains only 2-3 lines. The constand is a URL with an
"=" sign in it. How and where could I build a rule to give this a
score of 10 or so?
Mike W
--
Registered Linux - 256979
NRA Life
ARS: W0TMW
-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
