On 09/06/2011 12:07 PM, Axb wrote:
> On 2011-09-06 12:03, J4K wrote:
>> On 09/06/2011 10:58 AM, Axb wrote:
>>> On 2011-09-06 10:43, J4K wrote:
>>>> Hi,
>>>>
>>>> I know that this is probably the hundredth time I have
>>>> emailed to
>>>> the list about my custom rules. Usually, someone points out the
>>>> blindingly obvious when I fail to note it. This has been going on for
>>>> months. I'll have a last hack at this, and then be quiet on this
>>>> topic
>>>> for at least a month, and then pester you all again. Apologies in
>>>> advance.
>>>>
>>>> I have a rule in the local.cf. I am trying to use it to
>>>> catch mail
>>>> show in http://pastebin.com/exWh652x
>>>> It does not hit.
>>>>
>>>> The two hits should be the Subject: Virtual Assistant Position
>>>> and the
>>>> email address hitting
>>>> web-newcarer\.(com|net)\,Thank
>>>>
>>>>
>>>>
>>>> describe PRIVATE_RULE1 English language job opportunity
>>>> body __PR1 /(Employment opportunity|Job offer match,
>>>> respond to apply|Employment you've been searching|Job
>>>> opportunity|Career opportunity inside|Position opening in your
>>>> area|Work
>>>> offer inside|Vacancy - apply online|Job ad - see details! Sent through
>>>> Search engine|Get a New Job Today|Working Part Time|Virtual Manager
>>>> Vacancy|Virtual Assistant Position|Start New Employment Today)/i
>>>> uri __PR2
>>>> /(joblists\.(com|net)|web-newcarer\.(com|net)|web-newcarer\.(com|net)\,Thank|gb-totaljob\.com)/i
>>>>
>>>>
>>>> meta PRIVATE_RULE1 (__PR1&& __PR2)
>>>> score PRIVATE_RULE1 2.5
>>>
>>>
>>> "\,Thank" in a uri rule?
>>>
>>> you don't need the __PR1 rule
>>>
>>> untested.. this should be enough to catch the stuff - no realy need
>>> for the body strings in __PR1
>>>
>>> rawbody RBODY_JOB_DOMAINS /\@(?:joblists|web-newcarer|gb-totaljob)\./
>>>
>>> h2h
>>>
>>>
>>>
>> Well, I put the Thank in there because I hoped it would catch the silly
>> email address that they put in. More than likely the reason it failed
>> is because of my incorrectly defined rule. Oh well, nice to keep you on
>> your toes!
>>
>> Thank-you for introducing me to rawbody rules.
>
> .-)
>
> http://wiki.apache.org/spamassassin/WritingRules
>
>> describe RBODY_JOB_DOMAINS English language job opportunity
>> rawbody RBODY_JOB_DOMAINS /\@(?:joblists|web-newcarer|gb-totaljob)\./
>> score RBODY_JOB_DOMAINS 2.5
>
> you could score those waaaaaaaaayyyyyyyyyyyyyyyyyyyyyyyyyyyyyy higher
> no chance of FPs unless some dumb "user" forwards that to another
>
>
>
Agreed. I intend to whack it up further once I have seen it hitting for
a day. I'll know tomorrow morning because the sending pattern is very
early in the morning CEST.
