I only got my hands on 3 of those, and they all have a very similar
Message-IDs
Message-ID: <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
I have put the following on 2 of our SA servers, thanks for your
contribution:
body L_DRUGS11 /([CVAXP] ){5}/
Header L_DRUGS12 MESSAGEID =~
/^<[EMAIL PROTECTED]>/
meta L_DRUGS1 L_DRUGS11 && L_DRUGS12
score L_DRUGS1 5
describe L_DRUGS1 Strange Message-ID and Spam signature in body.
- Ríkharður
-----Original Message-----
From: Pierre Thomson [mailto:[EMAIL PROTECTED]
Sent: 08 November, 2005 4:14 PM
To: Bowie Bailey; Spamassassin List (E-mail)
Subject: RE: More spam getting through
Bowie Bailey wrote:
>
> Some of the medication spams are using an obnoxious html table
> structure that makes the contents of each cell print vertically.
>
> For example:
> <table>
> <tr>
> <td>a d g</td>
> <td>b e h</td>
> <td>c f i</td>
> <td width=100%></td>
> <\tr>
> </table>
>
> This results in:
> a b c
> d e f
> g h i
>
> Has anyone else been having this problem? Any rules to catch
> medication names in those types of tables?
>
Here's a simple rule I wrote a couple days ago:
body PT_DRUG1 /([CVAXP] ){5}/
describe PT_DRUG1 Drug names in table of 1-letter columns
score PT_DRUG1 3.0
It works for me, no FP's yet that I am aware of. There are also
variants for 2-letter and 3-letter bits of the same drug names.
Good luck
Pierre Thomson
BIC
