On Wednesday 20 July 2005 06:30 am, Eddy Beliveau wrote:
> I'm receiving spams with the following subject line
> Subject: TRAMAD0OL, MER1DllA, \/ALUUM, XANA, L0RAAZEPAM, AMBllEN,
> ALPRAZZ0LAM, \/llGRA, CAALlS, LEVlTRRA

Here's what I've been using to catch these:

header __VALUUM                 Subject =~ /(V|\\\/)ALUUM/
header __VIGRA_PIPES            Subject =~ /(V|\\\/)\|+GRA/
header __CAALIS                 Subject =~ /CAAL\|+S/
header __LORAAZEPAM             Subject =~ /L[O0]RA+ZEPA+M/
header __LEVITRRA               Subject =~ /LE(V|\\\/)\|TR+A/
meta SENET_CAPDRUGOBFUS_OR      (__VALUUM || __VIGRA_PIPES || __CAALIS || 
__LORAAZEPAM || __LEVITRRA)
meta SENET_CAPDRUGOBFUS_01      (__VALUUM && (__VIGRA_PIPES || __CAALIS || 
__LORAAZEPAM || __LEVITRRA))
meta SENET_CAPDRUGOBFUS_02      (__VIGRA_PIPES && (__CAALIS || __LORAAZEPAM || 
__LEVITRRA))
meta SENET_CAPDRUGOBFUS_03      (__CAALIS && (__LORAAZEPAM || __LEVITRRA))
describe SENET_CAPDRUGOBFUS_OR  Caps drug obfuscation
describe SENET_CAPDRUGOBFUS_01  Caps drug obfuscation
describe SENET_CAPDRUGOBFUS_02  Caps drug obfuscation
describe SENET_CAPDRUGOBFUS_03  Caps drug obfuscation
score SENET_CAPDRUGOBFUS_OR     2.35
score SENET_CAPDRUGOBFUS_01     4.50
score SENET_CAPDRUGOBFUS_02     4.50
score SENET_CAPDRUGOBFUS_03     4.50

Reply via email to