#This grabs the un-decoded subject, your # rule was looking at the decoded subject. # You probably don't want to change this and make it scorable # since a ton of legit mail uses this charset header __MK_CHARSET_01 Subject:raw =~ /ISO\-8859/i describe __MK_CHARSET_01 Uses a ISO-8859
#What the subject you sent decodes to. header MK_BAD_SUBJECT_01 Subject =~ /lowest price insurance yet/i describe MK_BAD_SUBJECT_01 Nono phrase in the subject score MK_BAD_SUBJECT_01 0.2 #Combine the rules and give it a higher score. meta MK_BAD_SUBJECT_02 __MK_CHARSET_01 && MK_BAD_SUBJECT_01 describe MK_BAD_SUBJECT_02 Tries hiding a nono phrase with a different charset score MK_BAD_SUBJECT_02 1.5 Hope that helps, Mike > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Michael Satterwhite > Sent: Wednesday, December 24, 2003 9:49 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Question re: Rule > > > WARNING: Unsanitized content follows. > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > I've started to see some spam with subjects like the following: > > Satterwh, =?ISO-8859-1?B?bG93ZXN0IHByaWNlIGluc3VyYW5jZSB5ZXQu?= > > This is an obvious attempt to hide the subject so that it > won't be caught by > rules. I tried to write a rule to trap this type of encoding > as follows: > > header LENCSUBJECT Subject =~ /\=\?.*\?\=/i > Describe LENCSUBJECT (Local) Subject encoded > score LENCSUBJECT 1.5 > > If I feed the pattern above into perl and then try to match > on the subject > line from this email, it matches true. > > If I put it into my rules file and test against Spamassassin, > it doesn't > match. I'm obviously missing something. Can one of you gurus help? > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) > > iD8DBQE/6adgjeziQOokQnARAkeJAKC62u1rpAVm+cvC+qGW2j1nL4YusgCeMrd/ > n2klvd5vuhvSmT3Up8tC0XY= > =qvFi > -----END PGP SIGNATURE----- > > > > ------------------------------------------------------- > This SF.net email is sponsored by: IBM Linux Tutorials. > Become an expert in LINUX or just sharpen your skills. Sign > up for IBM's > Free Linux Tutorials. Learn everything from the bash shell > to sys admin. > Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
