Randal, Phil skrev:
body NICE_GIRL_03 /Email me at .{,74} only, because I am writing
not from my personal email\./
Would do nicely.
No need to be too clever here.
Cheers,
Phil
Apparently that won't work on all systems... (And that's why I ran into
problems before..)
On my SUSE system, I have to add the 0 as well, simply {,74} won't do,
but {0,74} works just fine.
Anders.
-----Original Message-----
From: Kris Deugau [mailto:[EMAIL PROTECTED]
Sent: 19 February 2008 21:16
To: users@spamassassin.apache.org
Subject: Re: "Nice girl like to chat" spam
ItsMikeE wrote:
For some time now I have been getting spams that look like
"Hello! I am tired this evening. I am nice girl that would
like to chat with
you. Email me at [EMAIL PROTECTED] only, because I am using
my friend's email
to write this. To see my pics"
They are still not being picked up, despite me passing them
to be learnt for
the bayes DB.
Has anyone written a rule to filter these out?
I've actually been running this set of 5 rules on several of the ISP
mail systems I've got my fingers in (watch for line wrap, sorry):
# "Nice girl" wants to send pics, but only if you email the
address in
the body
# start scoring at .5, see how that whacks'em.
body NICE_GIRL_01 /Hello! I am (?:bored|tired) (?:today|this
(?:afternoon|evening)|tonight)\./
describe NICE_GIRL_01 Nice girls don't spam
score NICE_GIRL_01 0.8
body NICE_GIRL_02 /I am nice girl that would like to
chat with you\./
describe NICE_GIRL_02 Nice girls don't spam
score NICE_GIRL_02 0.8
body NICE_GIRL_03 /Email me at [^\s]{,74} only, because I am
writing not from my personal email\./
describe NICE_GIRL_03 Nice girls don't spam
score NICE_GIRL_03 0.8
# not actually the same spam, but same class/type
body NICE_GIRL_04 /I will respond right away and send a pic and
some of my info right away/
score NICE_GIRL_04 0.8
describe NICE_GIRL_04 Nice girls don't spam
body NICE_GIRL_05 /Reply to me and tell me about
yourself if you
want to chat/
score NICE_GIRL_05 0.8
describe NICE_GIRL_05 Nice girls don't spam
I've also bumped BAYES_99 to 4.8 (and IIRC bumped scores on
BAYES_90 and
BAYES_95 as well). For some reason I've been too lazy to bother
tracking down, I usually only see two rules hitting on these
messages -
more than enough to push them over the stock threshold of 5
(I've found
it better to tune rules and Bayes than fiddle with the
threshold score).
-kgd
