Hi all,
I've just received a message containing this in the headers:
Subject: _'P*R0"VE,N* ;T0. ;E;N:HA_N:C*E -P_E"Nl'S--,; fmgkkeb
There were no rule hits on the Subject line (this is 2.60).
It struck me that *any* subject line containing this much punctuation
is suspicious, so I hacked together a set of test rules to catch this:
header L_SUBJ_EXCESSIVE_PUNC_11_15 Subject =~ /([A-Za-z0-9 ]+[^A-Za-z0-9
]+){11,15}/
describe L_SUBJ_EXCESSIVE_PUNC_11_15 Subject contains excessive punctuation
score L_SUBJ_EXCESSIVE_PUNC_11_15 0.1
header L_SUBJ_EXCESSIVE_PUNC_16_20 Subject =~ /([A-Za-z0-9 ]+[^A-Za-z0-9
]+){16,20}/
describe L_SUBJ_EXCESSIVE_PUNC_16_20 Subject contains excessive punctuation
score L_SUBJ_EXCESSIVE_PUNC_16_20 0.1
... and so on up to 30.
These are cumulative, so a message which hits _16_20 will also hit
_11_15. I suspect this would work better as an eval rule, but I'm not
confident enough to try to write one.
Any comments on whether this is a reasonable approach?
I'll bugzilla this tomorrow.
Martin
--
Martin Radford | "Only wimps use tape backup: _real_
[EMAIL PROTECTED] | men just upload their important stuff -o)
Registered Linux user #9257 | on ftp and let the rest of the world /\\
- see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
