On 8/6/2014 2:39 PM, Alex wrote:
On Wed, Aug 6, 2014 at 1:32 PM, Paul Stead
<paul.st...@zeninternet.co.uk <mailto:paul.st...@zeninternet.co.uk>>
wrote:
06/08/14 16:28, Quanah Gibson-Mount wrote:
Would you be willing to share your full finalized ruleset? This
spam is really obnoxious.
Sure...
A little adjustment as I noticed the brackets around the first
number match was wrong:
header __LOC_DIGITS_FROM From:name =~ /\.\d{7,8}$/
body __LOC_DIGITS_CONFUSER / (\d{7,8}) .{1,250} ([0-9a-f]{32})
.{1,250}[\g1|\g2] .{1,250}[\g1|\g2]/
Something like...
meta LOC_DIGITS_SPAM (__LOC_DIGITS_FROM && __LOC_DIGITS_CONFUSER)
score LOC_DIGITS_SPAM 0.001
header __LOC_DIGITS_FROM From:name =~ /\.\d{7,8}$/
body __LOC_DIGITS_CONFUSER / (\d{7,8}) .{1,250} ([0-9a-f]{32})
.{1,250}[\g1|\g2] .{1,250}[\g1|\g2]/
meta LOC_DIGITS_SPAM ( __LOC_DIGITS_FROM && __LOC_DIGITS_CONFUSER)
score LOC_DIGITS_SPAM 0.001
This doesn't pass lint:
Looks like a couple of issues with the body rule. Try this:
header __LOC_DIGITS_FROM From:name =~ /\.\d{7,8}$/
body __LOC_DIGITS_CONFUSER / (\d{7,8}) .{1,250} ([0-9a-f]{32})
.{1,250}(?:\1|\2) .{1,250}(?:\1|\2)/
meta LOC_DIGITS_SPAM ( __LOC_DIGITS_FROM && __LOC_DIGITS_CONFUSER)
score LOC_DIGITS_SPAM 0.001
--
Bowie
