Why just check the rule Emporium! :)

Here they are, I need to add a few more combo's next week.

# These next six are VERY INTERESTING. I'm very proud of these babies.
# They help tag and find the random characters spammers put in. Works
GREAT!!!!

rawbody MY_OBFUZ /z(r|f|k|j|v|x)/i
describe MY_OBFUZ Z with unusual chars
score MY_OBFUZ .45

rawbody MY_OBFUJ /j(d|h|x|q|b|z|v|w)/i
describe MY_OBFUJ J with unusual chars
score MY_OBFUJ .45

rawbody MY_OBFUY /y(b|j)/i
describe MY_OBFUY Y with unusual chars
score MYU_OBFUY .45

rawbody MY_OBFUX /x(b|f|d|h|u)|dh|uj|vsh/i
describe MY_OBFUX X with unusual chars
score MY_OBFUX .45

rawbody MY_OBFUT /t(q|b|f|j)/i
describe MY_OBFUT T with unusual chars
score MY_OBFUT .45

rawbody MY_OBFU_MISC /dh|uj|vsh/i
describe MY_OBFU_MISC Misc unusual chars together
score MY_OBFU_MISC .33

# I have a negative score to counter FAQ.

rawbody MY_NO_QU /q[^Uu]/i
describe MY_NO_QU Q without a U
score MY_NO_QU .5

Chris Santerre 
System Admin and SA Custom Rules Emporium keeper 
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm 
"A little nonsense now and then, is relished by the wisest men." - Willy
Wonka 


> -----Original Message-----
> From: Andrea Riela [mailto:[EMAIL PROTECTED]
> Sent: Friday, July 25, 2003 5:26 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] spam funny
> 
> 
> Hi folks,
> 
> I receive a lot of spam (html or text only) that has at the 
> end a funny
> expression, always different, like this:
> 
> acxfic z fvddx n th   r j eghqyxun hlchd rpk zgrxlkd
> bqnkstszzwyoyh heljsi
> r
> 
> Could I filter this spam? And if yes, how? Advices?
> Thanks for all
> Best Regards
> Andrea Riela
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet
> _072303_01/01
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
> 


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to