On 2011-09-06 12:03, J4K wrote:
On 09/06/2011 10:58 AM, Axb wrote:
On 2011-09-06 10:43, J4K wrote:
Hi,
I know that this is probably the hundredth time I have emailed to
the list about my custom rules. Usually, someone points out the
blindingly obvious when I fail to note it. This has been going on for
months. I'll have a last hack at this, and then be quiet on this topic
for at least a month, and then pester you all again. Apologies in
advance.
I have a rule in the local.cf. I am trying to use it to catch mail
show in http://pastebin.com/exWh652x
It does not hit.
The two hits should be the Subject: Virtual Assistant Position and the
email address hitting
web-newcarer\.(com|net)\,Thank
describe PRIVATE_RULE1 English language job opportunity
body __PR1 /(Employment opportunity|Job offer match,
respond to apply|Employment you've been searching|Job
opportunity|Career opportunity inside|Position opening in your area|Work
offer inside|Vacancy - apply online|Job ad - see details! Sent through
Search engine|Get a New Job Today|Working Part Time|Virtual Manager
Vacancy|Virtual Assistant Position|Start New Employment Today)/i
uri __PR2
/(joblists\.(com|net)|web-newcarer\.(com|net)|web-newcarer\.(com|net)\,Thank|gb-totaljob\.com)/i
meta PRIVATE_RULE1 (__PR1&& __PR2)
score PRIVATE_RULE1 2.5
"\,Thank" in a uri rule?
you don't need the __PR1 rule
untested.. this should be enough to catch the stuff - no realy need
for the body strings in __PR1
rawbody RBODY_JOB_DOMAINS /\@(?:joblists|web-newcarer|gb-totaljob)\./
h2h
Well, I put the Thank in there because I hoped it would catch the silly
email address that they put in. More than likely the reason it failed
is because of my incorrectly defined rule. Oh well, nice to keep you on
your toes!
Thank-you for introducing me to rawbody rules.
.-)
http://wiki.apache.org/spamassassin/WritingRules
describe RBODY_JOB_DOMAINS English language job opportunity
rawbody RBODY_JOB_DOMAINS /\@(?:joblists|web-newcarer|gb-totaljob)\./
score RBODY_JOB_DOMAINS 2.5
you could score those waaaaaaaaayyyyyyyyyyyyyyyyyyyyyyyyyyyyyy higher
no chance of FPs unless some dumb "user" forwards that to another
