On Fri, 18 Mar 2005 09:37:09 -0500, Bowie Bailey <[EMAIL PROTECTED]> wrote: > From: Roman Serbski [mailto:[EMAIL PROTECTED] > > > > Dear all, > > > > Could you please help me with one SA subject rule that sometimes works > > and sometimes doesn't. > > > > SpamAssassin 3.0.2 with qmail-scanner 1.25st. > > > > Everything works like a charm but we receive a lot of spam messages > > from yahoo.com group with [expoforum_kg] subject. I created a rule in > > 20_head_tests.cf to score all messages containing [expoforum_kg] in a > > subject. I know I shouldn't use global cf rules but I was just > > testing. > > > > 20_head_tests.cf: > > > > header EXPO_SUCKERS Subject =~ /\b(?:[a-z]([-_. > > =~\/:,[EMAIL PROTECTED]&+;\"\'<>\\])\1{0,2}){4,}/i > > describe EXPO_SUCKERS Subject: contains [expoforum_kg] > > > > > > This is an example of successful detection: > > > > subj='[expoforum_kg] A D V E R T I S E - TO - M I L L I O N S' > > > > This is an example of unsuccessful detection: > > > > subj='[expoforum_kg] Paid ontime 50% profit' > > The problem is that your rule is matching the expanded text seen in the > first subject rather than the '[expoforum_kg]' that you seem to expect. Try > this rule instead: > > header EXPO_SUCKERS Subject =~ /\b\[expoforum_kg\]\b/i
Thank you Bowie, I tried your advise but it didn't work. :( Sat, 19 Mar 2005 11:51:04 KGT:16213: from='Neomarketing <[EMAIL PROTECTED]>', subj='[expoforum_kg] E M A I L - M I L L I O N S - N O W !', via SMTP from 66.94.237.28 Sat, 19 Mar 2005 11:51:06 KGT:16213: uvscan: finished scan in 1.884296 secs Sat, 19 Mar 2005 11:51:23 KGT:16213: SA: REPORT hits = -0.8/3.5 1.3 GAPPY_SUBJECT Subject: contains G.a.p.p.y-T.e.x.t 0.5 TARGETED BODY: Targeted Traffic / Email Addresses Sat, 19 Mar 2005 11:51:23 KGT:16213: SA: required_hits 3.5 / sa_quarantine +2.1 / sa_delete +4.2 Sat, 19 Mar 2005 11:51:23 KGT:16213: SA: finished scan in 17.650532 secs - hits=-0.8 Sat, 19 Mar 2005 11:51:23 KGT:16213: p_s: finished scan in 0.061538 secs 20_head_tests.cf: header EXPO_SUCKERS Subject =~ /\b\[expoforum_kg\]\b/i describe EXPO_SUCKERS Subject: contains [expoforum_kg] spamassassin --lint -D doesn't show any errors. Anything else to check? Thank you for your time.
