Hi all,
in the last view days I experienced some (for me) strange kind of spam.
The first part of the email is a random text (that's what I see in my email
client when opening the email):
snip
embedding rose abalone freedman havana bayport regretful menlo gate
blomquist
force parasitic
Hi Jürgen!
you need some rules for SA which can detect obfuscated spellings of
those keywords like vagira, cilais a.s.o.
heres a sample rule i normally use for such words
body MY_OBF1
/((?!*censored*)(?:(?:[EMAIL PROTECTED]|@])|(?:v\W*[i|1]\W*[a|@]\W*g\W*r\W*[a|@])))/i
describe MY_OBF1 body:
At 11:56 AM 1/21/04 +0100, Jürgen R. Plasser wrote:
Is there any way to get rid (say: score 5) of those mails with SA? Some
rules?
I have SA 2.61 and the latest Bigevel rules installed.
Well, antidrug is a good start.
http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
Subject:
[SAtalk] This spam scores too low
From:
Jürgen R. Plasser [EMAIL PROTECTED]
Date:
Wed, 21 Jan 2004 11:56:34 +0100
To:
[EMAIL PROTECTED]
Hi all,
in the last view days I experienced some (for me) strange kind of spam.
The first part of the email
Thanks for your very helpful answers.
Jürgen
--On 21.01.2004 11:56 +0100 Jürgen R. Plasser wrote:
Hi all,
in the last view days I experienced some (for me) strange kind of spam.
The first part of the email is a random text (that's what I see in my
email client when opening the email):
...