While we have discussed catching random letters, I wanted to go over a finding. If you use my OBFU rules, or change Fred's to rawbody, there is one instance of FPs you can watch out for. (Both sets found on the wiki http://www.exit0.us)
Emails written in Word will tend to hit these rawbody rules due to encoding. Only thing you can do is setup a Meta to make sure it isn't an email written in word, or give emails written in word a negative score. Whichever you choose, pick an obscure way to determine it is an email written in word. Don't go for the obvious. The more obscure the better. Also keep in mind that different versions of word have different encoding. So I would make separate obscure rules. This way spammers can't start falsifying word emails. Even if they do, you would have not based the rule on an obvious Word tag. Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
