On Sat, 23 Oct 2010 14:28:38 -0230
"Lawrence @ Rogers" <lawrencewilli...@nl.rogers.com> wrote:
> Hello all,
>
> I noticed recently that our users are getting spam with the subject
> similar to the following:
>
> SehxpyNaturalRedheaddFayeReaganHasHerFirstLesbianExperienceWithBrunet
>
I got some of these a while ago. They were pretty hard to catch because
they came through Hotmail and had little to work with in the body.
I added:
header SUBJ_LONG_WORD Subject =~ /\b[^[:space:][:punct:]]{30}/
describe SUBJ_LONG_WORD Longwordinsubjectlikethis
score SUBJ_LONG_WORD 2.0
header SUBJ_JOIN_CAP_WORD Subject =~
/([[:upper:]]+[[:lower:]]+){5}/
describe SUBJ_JOIN_CAP_WORD JoinedCapitalizedWordsRuntogether
score SUBJ_JOIN_CAP_WORD 1.5
They are missing some "?:", but for single header rules I don't really
care.
