On Tue, 06 Jan 2004 08:03:59 +0100
John Wilcock <[EMAIL PROTECTED]> wrote:
> On Sun, 4 Jan 2004 13:35:30 -0700, Anthony Martinez wrote:
> > In the spam that has deliberate bayes-busters (three lines of random words), the
> > X-Mailer header is totally bogus, like this
> >
> > X-Mailer: cyan exiting space
> >
> > header XMAILERBOGUS X-Mailer =~ /^[^A-Z0-9]*$/
> > describe XMAILERBOGUS X-Mailer header has NO uppercase letters, NO
> > numbers... How do you expect me to believe that
> > score XMAILERBOGUS 0.5
> >
> > I *think* this would work but I'm not going to implement it without running this
> > by the list - my regexp skills aren't top-notch.
>
> It seems to work fine - hits all those bayes-buster spams. However, it
> also hits messages with no X-Mailer header at all - which I suspect
> may lead to FPs. To exclude this, I've changed it to:
>
> header local_XMAILER_BOGUS X-Mailer =~ /^[a-z][^A-Z0-9]*$/
>
> which seems to work fine.
I like that too. Just using + instead of * would amend the problem of hitting
with no X-Mailer header as well.
Ciao
Racke
--
LinuXia Systems => http://www.linuxia.de/
Expert Interchange Consulting and System Administration
ICDEVGROUP => http://www.icdevgroup.org/
Interchange Development Team
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
