Hello jdow, Sunday, May 8, 2005, 4:21:26 AM, you wrote:
j> This text sailed right through all the SARE rules except one ratware j> rule: j> ===8<--- j> X-Spam-Status: No, score=4.4 required=5.0 j> tests=BAYES_80,DATE_IN_PAST_12_24, j> RATWR10a_MESSID,URIBL_SBL autolearn=disabled version=3.0.2 j> Status: How old are your rules files? Ratware as a rules file and rules name has been discontinued since last September. All Message ID rules should now be in the 70_sare_header*.cf files, with a SARE_MSGID_* name. j> You will see how great this storewide ssale is. Customers can sav a j> lot of rnoney on tablets at our store. Some of the obfuscations in the sample you sent should already be picked up by the new 70_sare_obfu* files, and other rules are being tested (my mass-check is running as I type). j> There are too many creative ways to mangle words and still have the j> original meaning get through. (But, perhaps anybody who would do j> any business with these creeps who cannot spell has earned what j> they get....) Agreed, but some manglings are popular enough to be worth writing a rule for, even if that rule pays off for only a month before that particular mangling is dropped. Yes, please send me a copy and I'll see if it has new manglings worth testing for. I suggest you compress the email file, so it doesn't hit any filters. :-) Bob Menschel
