On Thu, 13 Jun 2013, Alex wrote:

Hi,

On Thu, Jun 13, 2013 at 9:55 PM, John Hardin <jhar...@impsec.org> wrote:
On Thu, 13 Jun 2013, Amir 'CG' Caspi wrote:

Lately, I've been getting hit with a LOT of this type of spam:

http://pastebin.com/HD0rNdxU

http://ruleqa.spamassassin.org/20130613-r1492572-n/STYLE_GIBBERISH/detail

John, I've just tried with your latest, and his sample doesn't hit
STYLE_GIBBERISH. Any suggestions?

Hmm. I created an HTML message with a series of words in the style tag and it did hit. I'll try it on your sample directly.

There are some FP-reduction exclusions, add a local rule like:

  meta   STYLE_GIBBERISH_RAW   __STYLE_GIBBERISH
  score  STYLE_GIBBERISH_RAW   0.0001

to see if the FP exclusions are keeping it from hitting for you.

--
 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhar...@impsec.org    FALaholic #11174     pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  Democrats '61: Ask not what your country can do for you,
   ask what you can do for your country.
  Democrats '07: Ask not what your country can do for you,
   demand it!
-----------------------------------------------------------------------
 4 days until SWMBO's Birthday

Reply via email to