RE: [SAtalk] paris hilton

[Yackley, Matt]

Haven't seen the spam but one of these should work if your example text is always the 
same:
 
header    YM_HS_OBFU_PARIS Subject =~ /\bp4r1s\b/i
describe YM_HS_OBFU_PARIS Subject contains "p4r1s"
score      YM_HS_OBFU_PARIS 10.0
 
body      YM_B_OBFU_PARIS /\bp4r1s\b/i
describe YM_B_OBFU_PARIS Subject contains "p4r1s"
score      YM_B_OBFU_PARIS 10.0
 
-matt

        -----Original Message----- 
        From: [EMAIL PROTECTED] on behalf of ian douglas 
        Sent: Mon 11/24/2003 5:46 PM 
        To: [EMAIL PROTECTED] 
        Cc: 
        Subject: [SAtalk] paris hilton
        
        

        Anyone have any good obfuscation rules for p4r1s h1|+0n spam? I'm getting a
        ton of these every day...
        
        -id
        
        
        
        
        -------------------------------------------------------
        This SF.net email is sponsored by: SF.net Giveback Program.
        Does SourceForge.net help you be more productive?  Does it
        help you create better code?  SHARE THE LOVE, and help us help
        YOU!  Click Here: http://sourceforge.net/donate/
        _______________________________________________
        Spamassassin-talk mailing list
        [EMAIL PROTECTED]
        https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
        

†+w­zf¢–+,¦‰ìo$…ëFŠ÷›iÉ®ˆ+j`èzĺ·Šàzw­…éiÊ›zj+zšèvç-Š÷ƒ¡ë"¶¥§*.r·šµæÞ×r‡^Hp1Ä,åDjwazZn²¥¥ƒ”
Xœw«zm§ÿì¢êÜyú+éÞ÷h«^ý*Z™«,jË"žÖ’f¢–)à–+-J–¦j˲ȵ©d–+-²Ê.­Ç¢¸ëa¶Úlÿùb²Û,¢êÜyú+éÞùb²Û?–+-ŠwèþÊZ™«,jË"žÖ