You’re more than welcome to co-opt any rules I share if they’re of some value – it’s pretty even odds that I either gleaned them from elsewhere and “seasoned to suit” or had some help writing them from this group.
I’m curious however how they are being used in KAM.cf. Grepping the same, I have the following: > grep CBJ KAM.cf meta KAM_INSURE (__KAM_INSURE1 + __KAM_INSURE2 + __KAM_INSURE3 + __KAM_INSURE4 + KAM_ADVERT2 + (KAM_LOTSOFHASH || KAM_INFOUSMEBIZ || CBJ_GiveMeABreak) >= 3) meta KAM_INSURE2 (__KAM_INSURE1 + __KAM_INSURE2 + __KAM_INSURE3 + __KAM_INSURE4 + KAM_ADVERT2 + (KAM_LOTSOFHASH || KAM_INFOUSMEBIZ || CBJ_GiveMeABreak) >= 4) meta KAM_WARRANTY (__KAM_WARRANTY1 + __KAM_WARRANTY2 + __KAM_WARRANTY3 + __KAM_WARRANTY4 + CBJ_GiveMeABreak >= 3) # SPAM THAT TRIES TO BYPASS RULES LIKE CBJ_GiveMeABreak meta KAM_NOISE1 (__KAM_NOISE1 + __KAM_NOISE2 + (CBJ_GiveMeABreak || __CBJ_GiveMeABreak2) >= 3) (watch the line wrap) It seems the meta rules are referencing CBJ_GiveMeABreak but it isn’t defined anywhere in KAM.cf. How do folks ever trigger on it? ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From: Joe Quinn [mailto:jqu...@pccc.com] Sent: Monday, October 27, 2014 9:28 AM To: users@spamassassin.apache.org Subject: Re: __CBJ_GiveMeABreak2 We got this from Kevin Miller <kevin_mil...@ci.juneau.ak.us><mailto:kevin_mil...@ci.juneau.ak.us> who posted it to users@ on 15 May 2014. We've made some tweaks since then and because it's not ours we are hesitant to post it in KAM.cf, but here is what we are currently using: # HTML <BR> rawbody __CBJ_GiveMeABreak1 /(?:<\/?br ?\/?>[\s\r\n]{0,4}){8}/mi # NEWLINES - DISABLED rawbody __CBJ_GiveMeABreak2 /(?:[\r\n]){8}/mi # EMPTY TABLE ROWS rawbody __CBJ_GiveMeABreak3 /(?:<tr><td><\/td><\/tr>[\r\n]{0,4}){4}/mi # EMPTY PARAGRAPHS rawbody __CBJ_GiveMeABreak4 /(?:<p[^>]*> <\/p>\s*){4}/mi meta CBJ_GiveMeABreak (__CBJ_GiveMeABreak1 + __CBJ_GiveMeABreak3 + __CBJ_GiveMeABreak4 >= 1) describe CBJ_GiveMeABreak Messages with consecutive break characters score CBJ_GiveMeABreak 2.0 On 10/27/2014 12:59 PM, Paul Stead wrote: Noticed this in the latest KAM updates - does anyone have a copy of this sub rule? Paul -- Paul Stead Systems Engineer Zen Internet
