COuld it possible be the double base64 text trick again? Those tend to be goofy. I don't quite understand the darn trick myself. No one has posted a very good explanation yet. Does this spam hit the BASE64_ENC_TEXT rule?
--Chris > -----Original Message----- > From: John McGivern [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 20, 2003 9:08 AM > To: Robert Menschel > Cc: [EMAIL PROTECTED] > Subject: RE: [SAtalk] catching the Banned CD spam! > > > Hey everyone! Thanks for all the responses! I was out of > the office yesterday. > > I do have the /i at the end of my rule so it looks like this: > > body RULE_NAME /bannedc|banned c/i > > so that I could catch the case as well. > > I know that phrase is in there obviously but it just won't > find it! When I do a commnd line spamassassin -t < message > it just doesn't find it. I've done a --lint and there are no > qualms there. I've also tested that the rule fires by > sending emails with banned c and bannedc in the body and my > mail server finds it just fine. > > I think I must be doing something stupid but I just can't > figure out what it is! I think I have tested everything. > > I will try some of the variations that you have all suggested > and see what spamassassin gives me. > > Thanks! > > John McGivern > > -----Original Message----- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: August 18, 2003 10:09 PM > To: John McGivern > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] catching the Banned CD spam! > > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello John, > > I find the following rules work well for me: > > header RM_sp_BannedCD Subject =~ /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i > describe RM_sp_BannedCD Subject mentions the supposedly banned CD > score RM_sp_BannedCD 1.21 # 21 spam, 0 ham, Aug 12 2003 > > body RM_bp_BannedCD /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i > describe RM_bp_BannedCD Body mentions the supposedly banned CD > score RM_bp_BannedCD 1.21 # 231 spam, 0 ham, Aug 12 2003 > > Bob Menschel > > -----BEGIN PGP SIGNATURE----- > Version: PGP 8.0 > > iQA/AwUBP0GGzZebK8E4qh1HEQKazwCeI8VFy5lB4ZCJk2R2+OJHM/Q75swAoOfi > dJ3dxl42rdxD65ogGnogk+Ib > =resJ > -----END PGP SIGNATURE----- > > > Monday, August 18, 2003, 12:44:24 PM, you wrote: > > JM> Hi everyone, > > JM> I don't know if you guys get the SPAM that advertises the > "Banned CD" I get dozens of them. Anyway, I've added a body > rule looking for the term "bannedc" or "banned c" and yet it > still doesn't > JM> catch it eventhough the text is right there! I know the > rule is working because if I email myself something with this > phrase, it gets blocked. So, how do they put actual text in > an email and it > JM> by SA? The source for the email is below. > > > > > ------------------------------------------------------- > This SF.Net email sponsored by: Free pre-built ASP.NET sites including > Data Reports, E-commerce, Portals, and Forums are available now. > Download today and enter to win an XBOX or Visual Studio .NET. > http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet > _072303_01/01 > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > ------------------------------------------------------- > This SF.net email is sponsored by Dice.com. > Did you know that Dice has over 25,000 tech jobs available today? From > careers in IT to Engineering to Tech Sales, Dice has tech > jobs from the > best hiring companies. http://www.dice.com/index.epl?rel_code4 > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code=104 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
