I like to make lots of custom rules (I gratifying watching how effective they can be).
I have several that I update with porn words that spammers try to be clever with. In
your case:
body CLEVER_P0RN /(?:sexua1|0rgies|ph0t0s|sch00l)/i
Notice that they use one's for the letter L, zero's for the letter O, etc. You can
usually get away with assigning high scores to these since legitimate mailers don't
type 0rgies as a typo.
I would also make a C1ick here rule - starting to see this used often.
body C1CK_HERE eval:html_eval('anchor_text', '=~ /C1ick\s+here/i')
Hope this helps..
-----Original Message-----
From: German Staltari [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 10, 2003 10:53 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] tricky spam
Hi, i've attahced a very tricky SPAM mail that has been scored with 0.8
points, what can be done with this kind of SPAM?.
Thanks
German
-------------------------------------------------------
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
