On Wednesday, April 13, 2005, 1:42:10 PM, Stuart Johnston wrote:
> body L_STOX2 /st0ck\d{2}\s{0,[EMAIL PROTECTED],4}yahoo.com/i
FWIW, the st0ckNN @ yahoo.com spammer seems to have changed
back to 4 digits:
> If you wish to stop future mailings, or if you fee| you have been
> wrongful|y p|aced in
On Wed, 2005-04-13 at 13:22, Andreas Davour wrote:
> The following message have many characteristics in common with much spam
> I've been getting lately. It's about investments, often shares, stock
> options or oil. One odd thing about those messages is that they all,
> like the one quoted below
> -Original Message-
> From: Stuart Johnston [mailto:[EMAIL PROTECTED]
> Sent: 13 April 2005 21:42
> To: Andreas Davour
> Cc: users@spamassassin.apache.org
> Subject: Re: Need for a new rule?
>
> Andreas Davour wrote:
> >
> > The following message
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Andreas Davour wrote:
[snip]
| Are there any rule for this? Would one be hard do design? I haven't seen
| anything about is in the documentation. OR, I haven't understood what
| I've read...
I just wrote a bunch of obfu-rules with negative lookaheads an
Joe Kletch wrote:
>
>>>
>>>
>>> body L_STOX2 /st0ck\d{2}\s{0,[EMAIL PROTECTED],4}yahoo.com/i
>>>
>>
>>
>
> I added this rule a while back and removed the yahoo and it seems to
> help--but only adds 1.0 to the score and it wasn't enough to put the
> mail over my threshold of 3.5. How would I incre
On Apr 13, 2005, at 3:49 PM, SRH-Lists wrote:
There have been several threads about this specific spammer
in the last
few months. Some of them with this exact question - mostly
the answer
is no.
e mail with No Thanks in the subject to st0ck62 @ yahoo.com
It is much easier to match on this email
> While generic tests for character/letter obfuscation are
> difficult, this
> guy is pretty predictable.
>
> body SRH_PENNY2 /(?:e\s*mai\||mi[|l]{2}ions|resu\|ts|wi[|l]{2})/
>
> Add your own l->| words to this list, although he hasn't failed to use
> one in the list above in each one of hi
M>-Original Message-
M>From: Andreas Davour [mailto:[EMAIL PROTECTED]
M>Sent: 13 April 2005 21:23
M>Cc: users@spamassassin.apache.org
M>Subject: Need for a new rule?
M>
M>
M>The following message have many characteristics in common with much
M>spam I've been getting lately. It's about inve
> There have been several threads about this specific spammer
> in the last
> few months. Some of them with this exact question - mostly
> the answer
> is no.
>
> > e mail with No Thanks in the subject to st0ck62 @ yahoo.com
>
> It is much easier to match on this email address with someth
Andreas Davour wrote:
The following message have many characteristics in common with much spam
I've been getting lately. It's about investments, often shares, stock
options or oil. One odd thing about those messages is that they all,
like the one quoted below, have the letter 'l' substituted for
10 matches
Mail list logo
