> > Update of OBFU chr's rule. I think we can call them Fred's OBFU rules now. You did much more work on them then I did. Heck, you looked at a bunch of dictionaries. I can't even spell dictionary! :-)
> > rawbody __FVGT_rb_ATTACHMENT /Content-Disposition: attachment/i > body __FVGT_b_OBFU_J /j(b|c|f|g|w)/i > body __FVGT_b_OBFU_OTHER /(vj|vk|xj|xk|yy|zf|zj)/i > body __FVGT_b_OBFU_Q0 /(j|k|p|q|t|v|w|z)q/i > body __FVGT_b_OBFU_Q1 /q(a|f|h|j|k|m|n|s|y)/i > body __FVGT_b_OBFU_V /(f|g|q|w)v/i > body __FVGT_b_OBFU_X /(c|g|j|k|q|s|v|z)x/i > body __FVGT_b_OBFU_Z /(f|j|k|p|q|x)z/i > meta FVGT_m_MULTI_ODD ((__FVGT_b_OBFU_J + __FVGT_b_OBFU_OTHER + > __FVGT_b_OBFU_Q0 + __FVGT_b_OBFU_Q1 + __FVGT_b_OBFU_V + > __FVGT_b_OBFU_X + > __FVGT_b_OBFU_Z && !__FVGT_rb_ATTACHMENT) > 1) > describe FVGT_m_MULTI_ODD FVGT - contains multiple odd letter > combinations > score FVGT_m_MULTI_ODD 1.4 > > So So So very nice. Have you run this past an email written in MS.Word? I've seen some FP's on mine. I'm thinking you might need to add one more meta that checks to make sure it wasn't written in Word. I have a rule I can send you somewhere. You don't want to check the obvious stuff for word docs, as spammers can fake that. I'll test against this tomorrow and see. > This one is less likely to cause false positves when a > message contains a > double-forwarded attachment. > That's the only issues I've seen here. > Nice thinking! > Is this rule syntax legal? I didn't know I could combine an > additive rule > with a ! and have it all work ;) > Define "legal" ;) Looks OK to me! --Chirs Santerre ------------------------------------------------------- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Source Community? Make a contribution, and help us add new features and functionality. Click here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
