[SAtalk] This spam scores too low

2004-01-21 Thread Jürgen R. Plasser
Hi all, in the last view days I experienced some (for me) strange kind of spam. The first part of the email is a random text (that's what I see in my email client when opening the email): snip embedding rose abalone freedman havana bayport regretful menlo gate blomquist force parasitic

Re: [SAtalk] This spam scores too low

2004-01-21 Thread Ralf Vitasek
Hi Jürgen! you need some rules for SA which can detect obfuscated spellings of those keywords like vagira, cilais a.s.o. heres a sample rule i normally use for such words body MY_OBF1 /((?!*censored*)(?:(?:[EMAIL PROTECTED]|@])|(?:v\W*[i|1]\W*[a|@]\W*g\W*r\W*[a|@])))/i describe MY_OBF1 body:

Re: [SAtalk] This spam scores too low

2004-01-21 Thread Matt Kettler
At 11:56 AM 1/21/04 +0100, Jürgen R. Plasser wrote: Is there any way to get rid (say: score 5) of those mails with SA? Some rules? I have SA 2.61 and the latest Bigevel rules installed. Well, antidrug is a good start. http://mywebpages.comcast.net/mkettler/sa/antidrug.cf

Re: [SAtalk] This spam scores too low

2004-01-21 Thread Scott
Subject: [SAtalk] This spam scores too low From: Jürgen R. Plasser [EMAIL PROTECTED] Date: Wed, 21 Jan 2004 11:56:34 +0100 To: [EMAIL PROTECTED] Hi all, in the last view days I experienced some (for me) strange kind of spam. The first part of the email

Re: [SAtalk] This spam scores too low

2004-01-21 Thread Jürgen R. Plasser
Thanks for your very helpful answers. Jürgen --On 21.01.2004 11:56 +0100 Jürgen R. Plasser wrote: Hi all, in the last view days I experienced some (for me) strange kind of spam. The first part of the email is a random text (that's what I see in my email client when opening the email): ...