Chris, Thanks for the rules below. I'm a bit late jumping on some recent spam, since I was out of town on vacation, with an expensive dial-up connection. However, I have some variations you may want to consider (The Comma rule you may already have, and has proven very useful here -- the two others will be tested against my corpus tonight, after I play with them some more):
header RM_sl_Comma Subject =~ /\w,\w/ describe RM_sl_Comma Subject contains comma apparently embedded within a word score RM_sl_Comma 1.443 # 1188 spam, 36 ham Sep 27 2003; 1019s/22h of 33689 corpus header RM_sl_Parens Subject =~ /\w[;:()_"]\w/ describe RM_sl_Parens Subject contains parentheses or similar chars apparently embedded within a word score RM_sl_Parens 0.1 # %%% test header RM_sl_LeadChar Subject =~ / [;:().,]\w/ describe RM_sl_LeadChar Subject contains word which begins with non-word character score RM_sl_LeadChar 0.1 # %%% test Bob Menschel Thursday, October 9, 2003, 10:48:37 AM, you wrote: CS> There isn't any rule to catch this particular one. However here CS> are 2 hot off the press! CS> body MY_MTPARENS /\(\)/ CS> describe MY_MTPARENS Empty parens found. CS> score MY_MTPARENS .44 CS> body MY_CHARPARENS /[a-zA-Z]\([a-zA-Z]\)[a-zA-Z]/ CS> describe MY_CHARPARENS Char(char)Char CS> score MY_CHARPARENS .70 CS> They will be added to the emporium on the next update. (Which should be CS> before Xmas!) CS> Chris Santerre CS> System Admin and SA Custom Rules Emporium keeper CS> http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm CS> <http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm> CS> "A little nonsense now and then, is relished by the wisest men." - Willy CS> Wonka CS> -----Original Message----- CS> From: Eric Vollmer [mailto:[EMAIL PROTECTED] CS> Sent: Thursday, October 09, 2003 12:26 PM CS> To: [EMAIL PROTECTED] CS> Subject: [SAtalk] How does a message like this get through? CS> A little background on my mail system, my internet facing mail servers are CS> postfix 1.1.12 which CS> passes mail to amavisd-new for spam scanning. Once the spam check is done CS> it passes it to CS> our Symantec AV Gateway for virus scanning, also munges the headers from the CS> original smtp CS> transaction. Once scanned it is passed to groupwise for mailbox delivery. CS> My amavisd-new and CS> spamassassin are both the most current versions. CS> My question is, what is the threshold for subject/body text like V(A)G1NAS CS> or C()CKS to actually CS> invoke a score to be added to the overall score? CS> Any insight on this would be appreciated. CS> Thanks, CS> Eric Vollmer CS> Received: from sav2.domain.com [10.1.8.98] CS> by GW_M1.domain.com; Wed, 08 Oct 2003 21:57:17 -0400 CS> Received: from mail2.domain.com ([xx.xx.xx.xx]) CS> by sav2.domain.com (SAVSMTP 3.1.2.35) with SMTP id M2003100822111016948 CS> for <[EMAIL PROTECTED]>; Wed, 08 Oct 2003 22:11:10 -0400 CS> Date: Wednesday, 8 October 2003 10:00 CS> Message-ID: <[EMAIL PROTECTED]> CS> From: "Cindy" <[EMAIL PROTECTED]> CS> Subject: 15 Inch C()CKS in Tight V(A)G1NAS CS> To: [EMAIL PROTECTED] CS> Cc: CS> Content-Type: text/html; CS> charset=us-ascii CS> Content-Transfer-Encoding: 7bit CS> X-Spam-Status: No, hits=4.0 tagged_above=0.0 required=5.0 tests=HTML_80_90, CS> HTML_IMAGE_ONLY_02, HTML_MESSAGE, HTML_TAG_BALANCE_BODY, INVALID_DATE, CS> MIME_HTML_ONLY CS> X-Spam-Level: *** >><html><!--krugz--><head><!--jfvpou4f--></head><!--lkqubcuhi--> CS> <body><!--dqv1fdjbl--> CS> <a CS> href="http://corinnaplay.free-host.com/ex.html?JHbLuCR2y7j9RoW//UaFvw";><!--y qrybmw-->> CS> <img src="http://corinnaplay.free-host.com/ex.jpg"; border=0><!--593th5e--> CS> </html><!--llsmd8--> ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
![http://corinnaplay.free-host.com/ex.jpg"](http://corinnaplay.free-host.com/ex.jpg"){kind=link}