> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > n Behalf Of > McWhirter,Julia > Sent: Monday, January 12, 2004 12:34 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Detecting 10+ random words > > > > > > > This is a resubmission of a question that I have been > trying to sort out > for about a week now. I am trying to tag messages > that have more than > 10 random words in the message body of an incoming > e-mail I am running > the following > > > > Solaris 8 > > Sendmail 8.12.10 (+libmilter support) > > Mimedefang 2.39 > > Spamassassin 2.60 > > > > This is the .cf rule file > > > > rawbody RANDOMWORD_10 > /(?:\b(?!(?:from|even|more|were|with)\b)[a-z]{4,12}\s+){10}/ > > describe RANDOMWORD_10 string of 10+ random words > > score RANDOMWORD_10 0.5 > > > > rawbody RANDOMWORD_15 > /(?:\b(?!(?:from|even|more|were|with)\b)[a-z]{4,12}\s+){15}/ > > describe RANDOMWORD_15 string of 15+ random words > > score RANDOMWORD_15 2.5 > > > > Copied from this list last week.
Change it to body, rawbody retains the linefeeds and none of the lines listed are 10 words long. > > > > I have verified that the rule is being read via > spamassassin -D and that > the config produces no errors. > > > > Below is an exert from my sendmail logs that shows an > email that has got > through > > 09881 >>> 220 smtp.uk.superh.com ESMTP Sendmail > 8.12.10/8.12.10; Mon, 12 > Jan 200 > > 4 15:41:25 GMT > > 09881 <<< HELO HQAI7P9NL5OHSSQ > > 09881 >>> 250 smtp.uk.superh.com Hello > [211.168.218.78], pleased to meet > you > > 09881 <<< MAIL FROM: <[EMAIL PROTECTED]> > > 09881 >>> 250 2.1.0 <[EMAIL PROTECTED]>... Sender ok > > 09881 <<< RCPT TO: <[EMAIL PROTECTED]> > > 09881 >>> 250 2.1.5 <[EMAIL PROTECTED]>... > Recipient ok > > 09881 <<< DATA > > 09881 >>> 354 Enter mail, end with "." on a line by itself > > 09881 <<< Received: from [107.176.139.173] by > 211.168.218.78 with HTTP; > > 09881 <<< Tue, 13 Jan 2004 11:38:31 +0600 > > 09881 <<< From: "Patti Pate" <[EMAIL PROTECTED]> > > 09881 <<< To: [EMAIL PROTECTED] > > 09881 <<< Subject: ,,You can improve your looks > > 09881 <<< Mime-Version: 1.0 > > 09881 <<< X-Mailer: intestate > > 09881 <<< Date: Tue, 13 Jan 2004 09:34:31 +0400 > > 09881 <<< Reply-To: "Patti Pate" <[EMAIL PROTECTED]> > > 09881 <<< Content-Type: multipart/alternative; > > 09881 <<< boundary="07622999020661090" > > 09881 <<< Message-Id: <[EMAIL PROTECTED]> > > 09881 <<< > > 09881 <<< --07622999020661090 > > 09881 <<< Content-Type: text/plain; charset=us-ascii > > 09881 <<< Content-Transfer-Encoding: 8bit > > 09881 <<< > > 09881 <<< edging hayes catapult leavenworth font angus pumice > > 09881 <<< tenable rockford aggressor coffee plaza > swarm louise testicle > condemna > > te influenza > > 09881 <<< grebe bluejacket fried retail censure > abutting isaacson > > 09881 <<< gallonage comatose hegelian rudyard > credulous cosmopolitan > restoration > > > > 09881 <<< spayed vail address brasilia > > 09881 <<< widow tollgate grandstand cindy precede casey aegis > > 09881 <<< > > 09881 <<< --07622999020661090 > > > > 09883 === CONNECT sh-uk-ex01.uk.w2k.superh.com. > > 09883 <<< 220 sh-uk-ex01.uk.w2k.superh.com Microsoft > ESMTP MAIL Service, > Versio > > : 5.0.2195.6713 ready at Mon, 12 Jan 2004 15:43:08 +0000 > > 09883 >>> EHLO smtp.uk.superh.com > > 09883 <<< 250-sh-uk-ex01.uk.w2k.superh.com Hello > [193.128.105.170] > > 09883 <<< 250-TURN > > 09883 <<< 250-ATRN > > 09883 <<< 250-SIZE 15360000 > > 09883 <<< 250-ETRN > > 09883 <<< 250-PIPELINING > > 09883 <<< 250-DSN > > 09883 <<< 250-ENHANCEDSTATUSCODES > > 09883 <<< 250-8bitmime > > 09883 <<< 250-BINARYMIME > > 09883 <<< 250-CHUNKING > > 09883 <<< 250-VRFY > > 09883 <<< 250-X-LINK2STATE > > 09883 <<< 250-XEXCH50 > > 09883 <<< 250 OK > > 09883 >>> MAIL From:<[EMAIL PROTECTED]> SIZE=1195 > > 09883 <<< 250 2.1.0 [EMAIL PROTECTED] OK > > 09883 >>> RCPT To:<[EMAIL PROTECTED]> > > 09883 >>> DATA > > 09883 <<< 250 2.1.5 [EMAIL PROTECTED] > > 09883 <<< 354 Start mail input; end with <CRLF>.<CRLF> > > 09883 >>> Received: from HQAI7P9NL5OHSSQ ([211.168.218.78]) > > 09883 >>> by smtp.uk.superh.com > (8.12.10/8.12.10) with SMTP id > i0CFfODC00 > > 881 > > 09883 >>> for <[EMAIL PROTECTED]>; Mon, > 12 Jan 2004 > 15:41:28 GMT > > 09883 >>> Received: from [107.176.139.173] by > 211.168.218.78 with HTTP; > > 09883 >>> Tue, 13 Jan 2004 11:38:31 +0600 > > 09883 >>> From: "Patti Pate" <[EMAIL PROTECTED]> > > 09883 >>> To: [EMAIL PROTECTED] > > 09883 >>> Subject: ,,You can improve your looks > > 09883 >>> Mime-Version: 1.0 > > 09883 >>> X-Mailer: intestate > > 09883 >>> Date: Tue, 13 Jan 2004 09:34:31 +0400 > > 09883 >>> Reply-To: "Patti Pate" <[EMAIL PROTECTED]> > > 09883 >>> Content-Type: multipart/alternative; > boundary="07622999020661090" > > 09883 >>> Message-Id: <[EMAIL PROTECTED]> > > 09883 >>> X-Scanned-By: MIMEDefang 2.39 > > 09883 >>> > > 09883 >>> This is a multi-part message in MIME format... > > 09883 >>> > > 09883 >>> --07622999020661090 > > 09883 >>> Content-Type: text/plain; charset=us-ascii > > 09883 >>> Content-Transfer-Encoding: 8bit > > 09883 >>> Content-Disposition: inline > > 09883 >>> > > 09883 >>> edging hayes catapult leavenworth font angus pumice > > 09883 >>> tenable rockford aggressor coffee plaza > swarm louise testicle > condemn > > te influenza > > 09883 >>> grebe bluejacket fried retail censure > abutting isaacson > > 09883 >>> gallonage comatose hegelian rudyard > credulous cosmopolitan > restoratio > > > > 09883 >>> spayed vail address brasilia > > 09883 >>> widow tollgate grandstand cindy precede casey aegis > > 09883 >>> > > 09883 >>> --07622999020661090-- > > 09883 >>> . > > 09883 <<< 250 2.6.0 <[EMAIL PROTECTED]> > Queued mail for > delivery > > 09883 >>> QUIT > > 09883 <<< 221 2.0.0 sh-uk-ex01.uk.w2k.superh.com > Service closing > transmission c > > annel > > > > This is the header once it gets to exchange > > > > Microsoft Mail Internet Headers Version 2.0 > > Received: from smtp.uk.superh.com ([193.128.105.170]) by > sh-uk-ex01.uk.w2k.superh.com with Microsoft > SMTPSVC(5.0.2195.6713); > > Mon, 12 Jan 2004 15:43:08 +0000 > > Received: from HQAI7P9NL5OHSSQ ([211.168.218.78]) > > by smtp.uk.superh.com (8.12.10/8.12.10) > with SMTP id > i0CFfODC009881 > > for <[EMAIL PROTECTED]>; Mon, 12 > Jan 2004 15:41:28 > GMT > > Received: from [107.176.139.173] by 211.168.218.78 with HTTP; > > Tue, 13 Jan 2004 11:38:31 +0600 > > From: "Patti Pate" <[EMAIL PROTECTED]> > > To: [EMAIL PROTECTED] > > Subject: ,,You can improve your looks > > Mime-Version: 1.0 > > X-Mailer: intestate > > Date: Tue, 13 Jan 2004 09:34:31 +0400 > > Reply-To: "Patti Pate" <[EMAIL PROTECTED]> > > Content-Type: multipart/alternative; > boundary="07622999020661090" > > Message-Id: <[EMAIL PROTECTED]> > > X-Scanned-By: MIMEDefang 2.39 > > Return-Path: [EMAIL PROTECTED] > > X-OriginalArrivalTime: 12 Jan 2004 15:43:09.0093 (UTC) > FILETIME=[C7379550:01C3D922] > > > > --07622999020661090 > > Content-Type: text/plain; charset=us-ascii > > Content-Transfer-Encoding: 8bit > > Content-Disposition: inline > > > > > > --07622999020661090- > > > > Hope someone can help!! > > > > Regards > > Julia McWhirter > > IT Manager > > > > SuperH (UK) Ltd > > Network House > > 2410 Aztec West > > Almondsbury > > Bristol > > BS32 4QX > > > > Tel : 01454 465661 > > Fax : 01454 465601 > > Mobile : 07979 913494 > > Email : [EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]> > > Web : www.superh.com <http://www.superh.com> > > > > > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
