The last few days, I’ve been getting a lot of spams that have a similar
pattern. They are plain-text messages, and each one ends with a paragraph from
a restaurant review (apparently to confuse bayesian filters), with some numbers
inserted. There is an 8-digit decimal number and a 32-digit hex one. Each
number appears two or three times. This is a consistent enough pattern that I
wrote a rule to match it:
body REPEATED_TRACKING_NUMBERS / (\d{8}) .* ([0-9a-f]{32}) .*\g1.*\g2/
score REPEATED_TRACKING_NUBMERS 1
describe REPEATED_TRACKING_NUMBERS A large number and a hex hash, each showing
up at least twice.
The spaces in the regex are necessary to avoid matching notification emails
from eBay.
