On Fri, 7 Nov 2003, Chr. von Stuckrad wrote: > > Hi [snip..] > The mail also contained a broken variant of the wrong/forgotten > Parameter of their Spam-Mailer: ' $RANDOM IZE ' > > So: > > body RANDOM_IZE / \$RANDOM IZE / > score RANDOM_IZE 2 > describe RANDOM_IZE contains broken spamrobot parameter >
Even better, sprinkle in "\s?" between each of those letters and
you'll catch all permutations of that garbage.
EG:
body RANDOM_SPAM_TOOL /\s\$RA\s?N\s?D\s?O\s?M\s?I\s?Z\s?E\s/
Using the "\s" will catch it at line breaks too. ;)
I've combined that with other popular spam-tool 'RANDOM' signatures:
body L_SPAM_TOOL_3
/\[RANDOMIZE\].{0,3}\[RANDOMIZE\]|\s\$RA\s?N\s?D\s?O\s?M\s?I\s?Z\s?E\s|\b%%RANCHAR%%\b|\b%random_word|\b%random_text/
describe L_SPAM_TOOL_3 Spam tool pattern
score L_SPAM_TOOL_3 4.4
(Now we'll see if my own rules fire on this message. ;)
Dave
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
--- Begin Message --- achieve householder icosahedra corrugate bourgeoisie poets bender create postfix hustling bacchus imaginatively talking courses cranking matters hostelry bowel excommunicated polytope acclaim cries microscope abyssinia metronome scooping adjustors ternary scraps bobbins $RANDO MIZE counsellors adject cribs miller braking medial plugs bothered ethically pounding bombard poetical braided mealtime hurdle pneumococcus tearfully branches avis exams saws expositor bakhtiari memorandum merchandising tank scholastic creature excretions menhaden $RANDOM IZE brazenness meddle thallium hotelman playgrounds evens excise houseflies sears crate expunged huts scarcity popped boners expositions methylene plumage meandered possessor adviceschemas coverlets saxophone crosshatch coursing addictions branches pluperfect at&t bodhisattva craftsman brainwashes teacher hue meretricious horrible meticulous at&t tassel cowpoke adumbrates saturater port extemporaneous teletypewrite bodybuilder bangor pleading boaster crosswort $RANDOM IZE hydraulic andrea plugs bosom berlin acorn hygiene practitioner excited brambly postulated excise critique plied corridors ac cottonwood adores scrolls evince bombarding teletype sardonic savers meekness bamako potatoes sates telling admiralty $RANDOMI ZE adjustment poison excitement acculturated evenings migrated hygiene imagined additives hurrah cousins schedulers australia crossroad bahama sclerosis accoutrements banks advanced bluegrass bodhisattva
![]()
--- End Message ---
