That works! I'll give it a small score to fend off those FPs. Maybe combine it with a another test like: header SILD Subject =~ /Sildenafil Citrate/i :) Thanks!
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, September 09, 2003 4:20 PM To: Mike Kuentz (2) Cc: [EMAIL PROTECTED] Subject: Re: [SAtalk] [RD] Subject rule question Mike Kuentz (2) writes: > I see a lot of spams coming through hiding the subject masked using > ISO-8859, like this > > Subject: =?ISO-8859-1?b?SGFsZiBQcmljZWQgU2lsZGVuYWZpbCBDaXRyYXRl? > which translates back to a subject of: > > Half Priced Sildenafil Citrate > > obviously I can look for "Half Priced Sildenafil Citrate" in the subject, > but I want to write a rule for ISO-8859 in the subject. I have this rule, > but it doesn't appear to hit. > > header MK_CHARSET_IN_SUBJECT Subject =~ /ISO\-8859/i > > Does SA translate that before hand and that's why it's not hitting? It's > obviously a big thing for spammers, since a search on groups.google.com for > ISO-8859 turns up tons of results from news.admin.net-abuse.sightings. It translates it. Try header MK_CHARSET_IN_SUBJECT Subject:raw =~ /ISO\-8859/i but that will FP quite a lot on non-english words. or, of course, header SILD Subject =~ /Sildenafil Citrate/i ;) --j. ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
