On Thu, 16 Jul 2009, Benny Pedersen wrote:
> On Thu, July 16, 2009 12:47, rich...@buzzhost.co.uk wrote:
> > Don't you just love them :-)
Well, I seem to remember the nearly same scenario a long while ago.
Somebody went through nearly the same 'contorions' to always avoid
the last 'matching' which was shown on this list.
(Of course every good spammer will read the spamassassin list ;-)
At last the 'abstract patterns' were like
(the hostpattern and domains were different then):
www<string><hostpattern><string><topdomain>
and 'string' became so complicated, that a line was
added which said "please replace 'string' with a dot".
Of course this was the end of it - the dead giveaway
'replace pattern by a dot' caugt them soon ...
(This time they'll avoid this, after reading me :-)
The following Pattern, inserted in the plae of a 'dot'
catches all the typical variations of 'bracketing the dot'
(either with a '.' or with 'dot'):
(?:[\[({]\.[\])}]|[\[({]dot[\])}])
Hope that helps, Stucki
