This appears to work okay :-
header __LOCAL_PROBE1 subject =~ /[0-9]{4,6}/i
body __LOCAL_PROBE2 /([a-z|0-9]{8})/i
describe LOCAL_PROBE1 Daft Number Probe
meta LOCAL_PROBE1 (__LOCAL_PROBE1 + __LOCAL_PROBE2 > 1)
score LOCAL_PROBE1 3
Regards,
--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: [EMAIL PROTECTED]
----- Original Message -----
From: "Greg Skouby" <[EMAIL PROTECTED]>
To: users@spamassassin.apache.org
Sent: Tuesday, August 7, 2007 2:14:44 PM (GMT) Europe/London
Subject: Re: Number spam (paranoid guess)
On Tue, Aug 07, 2007 at 12:14:31PM +0200, Chr. v. Stuckrad wrote:
>
> My most paranoid guess is:
>
> - Cause: we have summer vacation time ...
>
> So LOTS of people are on holidays.
> If you use E-Mails with totally useless content which goes
> through all filters for a short time, you can trigger LOTS
> of vacation-Messages!
>
Wouldn't that require the "from" info not being forged? I have gotten a couple
of these and they are definately of the forged sender variety.
--Greg
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
