Sorry to hear about your problem. <g>
In the example you show below, there's a sequence of HTML text,
but you didn't tell us how it was encoded in the e-mail message (ie, clear text
or base64)
Lots of spammers encode their messages to avoid being detected by
simple text string matches.
Per the documentation,
full SYMBOLIC_TEST_NAME /pattern/modifiers
Define a full-body pattern test. "pattern" is a Perl regular
expression.
The 'full body' of a message is the un-decoded text, including all
parts (including images or other attachments). SpamAssassin no
longer tests full tests against decoded text; use "rawbody" for
that.
[...]
rawbody SYMBOLIC_TEST_NAME /pattern/modifiers
Define a raw-body pattern test. "pattern" is a Perl regular
expression.
The 'raw body' of a message is the text, including all textual
parts. The text will be decoded from base64 or quoted-printable
encoding, but HTML tags and line breaks will still be present.
[...]
body SYMBOLIC_TEST_NAME /pattern/modifiers
Define a body pattern test. "pattern" is a Perl regular expres-
sion.
The 'body' in this case is the textual parts of the message body;
any non-text MIME parts are stripped, and the message decoded from
Quoted-Printable or Base-64-encoded format if necessary. The mes-
sage Subject header is considered part of the body and becomes the
first paragraph when running the rules. All HTML tags and line
breaks will be removed before matching.
I'm guessing for the type of checking that you're performing below that you
want to use "body", as in:
body LOCAL_ENLARGEMENT /enlargement/i
describe LOCAL_ENLARGEMENT Refers to enlargement
score LOCAL_ENLARGEMENT 3
You're using rather high weights for these terms 'pen*s enlargement' is one
thing,
but the single word enlargement appears in ordinary use. You might try the
following
to narrow things down a bit:
body LOCAL_ENLARGEMENT /(Penis|Male) enlargement|enlargement
(pill|product)|enlarge your (penis|member|manhood)/i
describe LOCAL_ENLARGEMENT Refers to enlargement
score LOCAL_ENLARGEMENT 3
My apologies for the explicit references.
Alternatively, you might want to review the patterns that already exist along
these
lines in /usr/share/spamassassin/20_phrases.cf. Look for PENIS_ENLARGE and
related filters.
If these are already triggering, then you may just want to up their score. Look
in
50_scores.cf to see how they're presently being scored. You should put your
scores either
in your own user_prefs file, or in the site wide
/etc/mail/spamassassin/local.cf file,
and not overwrite the distribution values under /usr/share/spamassassin.
> -----Original Message-----
> From: Andrea Riela
> Sent: Saturday, August 02, 2003 7:09 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Problem with "penis enlargement" :)
>
>
> Hi folks,
>
> I've problem with one type of spam.
> This is my HTML source code:
>
> <...>
> <br>
> Doctors Create VPRX Penis Enlargement Pills<br>
> <br>
> </font><font face="Helvetica, Arial, sans-serif"><font
> size="-1"><big>Gain Up
> <...>
>
> My SA rules like these:
>
> full LOCAL_ENLARGEMENT /enlargement/i
> describe LOCAL_ENLARGEMENT Refers to enlargement
> score LOCAL_ENLARGEMENT 3
[...]
> But doesn't work (no match).
> Where is the mistake?
> Could you help me?
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
