body NICE_GIRL_03 /Email me at .{,74} only, because I am writing
not from my personal email\./
Would do nicely.
No need to be too clever here.
Cheers,
Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
> -----Original Message-----
> From: Kris Deugau [mailto:[EMAIL PROTECTED]
> Sent: 19 February 2008 21:16
> To: users@spamassassin.apache.org
> Subject: Re: "Nice girl like to chat" spam
>
> ItsMikeE wrote:
> > For some time now I have been getting spams that look like
> > "Hello! I am tired this evening. I am nice girl that would
> like to chat with
> > you. Email me at [EMAIL PROTECTED] only, because I am using
> my friend's email
> > to write this. To see my pics"
> >
> > They are still not being picked up, despite me passing them
> to be learnt for
> > the bayes DB.
> >
> > Has anyone written a rule to filter these out?
>
> I've actually been running this set of 5 rules on several of the ISP
> mail systems I've got my fingers in (watch for line wrap, sorry):
>
> # "Nice girl" wants to send pics, but only if you email the
> address in
> the body
> # start scoring at .5, see how that whacks'em.
> body NICE_GIRL_01 /Hello! I am (?:bored|tired) (?:today|this
> (?:afternoon|evening)|tonight)\./
> describe NICE_GIRL_01 Nice girls don't spam
> score NICE_GIRL_01 0.8
> body NICE_GIRL_02 /I am nice girl that would like to
> chat with you\./
> describe NICE_GIRL_02 Nice girls don't spam
> score NICE_GIRL_02 0.8
> body NICE_GIRL_03 /Email me at [^\s]{,74} only, because I am
> writing not from my personal email\./
> describe NICE_GIRL_03 Nice girls don't spam
> score NICE_GIRL_03 0.8
> # not actually the same spam, but same class/type
> body NICE_GIRL_04 /I will respond right away and send a pic and
> some of my info right away/
> score NICE_GIRL_04 0.8
> describe NICE_GIRL_04 Nice girls don't spam
> body NICE_GIRL_05 /Reply to me and tell me about
> yourself if you
> want to chat/
> score NICE_GIRL_05 0.8
> describe NICE_GIRL_05 Nice girls don't spam
>
> I've also bumped BAYES_99 to 4.8 (and IIRC bumped scores on
> BAYES_90 and
> BAYES_95 as well). For some reason I've been too lazy to bother
> tracking down, I usually only see two rules hitting on these
> messages -
> more than enough to push them over the stock threshold of 5
> (I've found
> it better to tune rules and Bayes than fiddle with the
> threshold score).
>
> -kgd
>
