> -----Original Message----- > From: Daniel Bird [mailto:[EMAIL PROTECTED] > Sent: Wednesday, July 30, 2003 7:06 AM > To: SA List > Subject: [SAtalk] [RD] Random characters in SPAM > > > Hi all, > Someone posted a rule a while back to catch those little buggers, but > for the life of me I can't find it. Can someone point me in the right > direction or re post please. > > TIA > > Dan >
Someone, I'll let him make the anouncment when he's ready, is working on making it easier to find rules on my site. Hopefully it will be very cool! These could use some more tweaking. I will update this week. Also the "Q with no U" rule will hit on the word FAQ. But I have a negative rule for FAQ that is bounded, so they cancel each other out. rawbody MY_NO_QU /q[^Uu]/i describe MY_NO_QU Q without a U score MY_NO_QU .5 # These next six are VERY INTERESTING. I'm very proud of these babies. # They help tag and find the random characters spammers put in. Works GREAT!!!! rawbody MY_OBFUZ /z(r|f|k|j|v|x)/i describe MY_OBFUZ Z with unusual chars score MY_OBFUZ .45 rawbody MY_OBFUJ /j(d|h|x|q|b|z|v|w)/i describe MY_OBFUJ J with unusual chars score MY_OBFUJ .45 rawbody MY_OBFUY /y(b|j)/i describe MY_OBFUY Y with unusual chars score MYU_OBFUY .45 rawbody MY_OBFUX /x(b|f|d|h|u)|dh|uj|vsh/i describe MY_OBFUX X with unusual chars score MY_OBFUX .45 rawbody MY_OBFUT /t(q|b|f|j)/i describe MY_OBFUT T with unusual chars score MY_OBFUT .45 rawbody MY_OBFU_MISC /dh|uj|vsh/i describe MY_OBFU_MISC Misc unusual chars together score MY_OBFU_MISC .33 Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
