Savoy, Jim wrote:
I think you need to change:
body NICE_GIRL_01 /Hello! I am (?:bored|tired)
(?:today|this(?:afternoon|evening)|tonight)\./
to:
body NICE_GIRL_01 /Hello! I am (?:bored|tired) (?:today|this
(?:afternoon|evening)|tonight)\./
(ie add a after the word "this").
It probably got l
ItsMikeE wrote:
> I have been running this rule for a day now, and am trapping
> the spams with rules 1 and 2.
I too just started running these rules, but noticed there were a lot
more NICE_GIRL_02's than NICE_GIRL_01's being hit (about twice as many
of the former).
I think you need to change:
On 18 Feb 2008, Jari Fredriksson told this:
> All it takes is a Unix/Linux user who does not know about smart hosts
Or who doesn't have one because it costs a lot extra and/or because the
smarthost is unreliable (and, no, `just change ISP' doesn't work: in
much of the world one ISP has a quasi-mon
On 2/23/2008 4:35 AM, [EMAIL PROTECTED] wrote:
Say, if we're all getting the same spam, isn't that what we're paying
sa-update to catch? :-)
paying? who's charging you?
what software/appliance/antispam device are you using?
Say, if we're all getting the same spam, isn't that what we're paying
sa-update to catch? :-)
Joseph Brennan wrote:
This has worked very well here. This is more specific to the
sentence the "bored girl" always uses.
/Email me at [A-Za-z]{1,[EMAIL PROTECTED],25}\.info only/
I left my rule more non-specific because I saw a number of non-.info
domains early on. I also figured there was
This has worked very well here. This is more specific to the
sentence the "bored girl" always uses.
/Email me at [A-Za-z]{1,[EMAIL PROTECTED],25}\.info only/
Joseph Brennan
Columbia University Information Technology
Am 2008-02-18 17:26:57, schrieb ram:
> you usually wait for the first mail and then block all mails containing
> the domain
I do this too and it works nicely...
But sometimes I get the messages too fast in to put the new DOMAIN into
the list which has now over 780 lines/domains.
SO I have writ
On my SUSE system, I have to add the 0 as well, simply {,74} won't do,
but {0,74} works just fine.
Anders.
-Original Message-
From: Kris Deugau [mailto:[EMAIL PROTECTED]
Sent: 19 February 2008 21:16
To: users@spamassassin.apache.org
Subject: Re: "Nice girl like to chat&q
mailto:[EMAIL PROTECTED]
> Sent: 19 February 2008 21:16
> To: users@spamassassin.apache.org
> Subject: Re: "Nice girl like to chat" spam
>
> ItsMikeE wrote:
> > For some time now I have been getting spams that look like
> > "Hello! I am tired this evening
I have been running this rule for a day now, and am trapping the spams with
rules 1 and 2.
Curiously I have now starting picking these up on Bayes as well.
Thanks for your help, and to everyone who responded.
Kris Deugau wrote:
>
> # "Nice girl" wants to send pics, but only if you email the ad
Michael Hutchinson wrote:
body NICE_GIRL_01 /Hello! I am (?:bored|tired) (?:today|this
(?:afternoon|evening)|tonight)\./
Forgive my ignorance, but what does the question mark and colon do at
the start of the brackets? I have (bored|tired) in my own rules, so how
does (?:bored|tired) affec
Michael Hutchinson wrote:
> > body NICE_GIRL_01 /Hello! I am (?:bored|tired) (?:today|this
> > (?:afternoon|evening)|tonight)\./
>
> Forgive my ignorance, but what does the question mark and colon do at
> the start of the brackets? I have (bored|tired) in my own rules, so how
> does (?:bored
> I've actually been running this set of 5 rules on several of the ISP
> mail systems I've got my fingers in (watch for line wrap, sorry):
>
> # "Nice girl" wants to send pics, but only if you email the address in
> the body
> # start scoring at .5, see how that whacks'em.
> body NICE_GIRL_01
ItsMikeE wrote:
For some time now I have been getting spams that look like
"Hello! I am tired this evening. I am nice girl that would like to chat with
you. Email me at [EMAIL PROTECTED] only, because I am using my friend's email
to write this. To see my pics"
They are still not being picked up,
Unfortunately she changes the .info domain as often as she changes her
knickers. :-p
Cheers,
Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
> -Original Message-
> From: Michael Hutchinson [mailto:[EMAIL PROTECTED]
> Sent: 18 February 2008 20:10
> To: users@s
Resolved. Cleared my sa-keys directory and re-imported them all.
Regards,
--
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: F57A 0CBD DD19 79E9 1FCC A612 CB36 D89D 2C5A 3A84
// Keyserver: www.keyserver.net Key-ID: 0x2C5A3A84
// Phone: +44 84
sa-update --gpgkey 6C6191E3 --channel sought.rules.yerp.org
error: GPG validation failed!
The update downloaded successfully, but it was not signed with a trusted GPG
key. Instead, it was signed with the following keys:
6C6191E3
I recall seeing this on the list a while ago. How do you fix
Chris writes:
> On Monday 18 February 2008 6:29 am, ram wrote:
> > On Mon, 2008-02-18 at 06:14 -0600, Chris wrote:
> > > On Monday 18 February 2008 4:33 am, ItsMikeE wrote:
> > > > For some time now I have been getting spams that look like
> > > > "Hello! I am tired this evening. I am nice girl th
On Monday 18 February 2008 6:29 am, ram wrote:
> On Mon, 2008-02-18 at 06:14 -0600, Chris wrote:
> > On Monday 18 February 2008 4:33 am, ItsMikeE wrote:
> > > For some time now I have been getting spams that look like
> > > "Hello! I am tired this evening. I am nice girl that would like to chat
> >
> On Mon, 2008-02-18 at 06:14 -0600, Chris wrote:
>
>
> scoring BOTNET at 5.0 dont you get far too many FP's
> Besides how do you get clamav to score a plain text mail.
> Are you using the clam signatures for spam
Botnet "as is" is way dangerous for an ISP, but for personal defence it works
f
Engineer
Herefordshire Council
Hereford, UK
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: 18 February 2008 16:35
> To: users@spamassassin.apache.org
> Subject: Re: "Nice girl like to chat" spam
>
> I just use in user_prefs
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: 2008-02-18 11:35
> To: users@spamassassin.apache.org
> Subject: Re: "Nice girl like to chat" spam
>
>
> I just use in user_prefs
> body J_GIRL /\bgirl.*\bpic(ture)?s
I just use in user_prefs
body J_GIRL /\bgirl.*\bpic(ture)?s\b/
score J_GIRL 5
On Mon, 2008-02-18 at 06:14 -0600, Chris wrote:
> On Monday 18 February 2008 4:33 am, ItsMikeE wrote:
> > For some time now I have been getting spams that look like
> > "Hello! I am tired this evening. I am nice girl that would like to chat
> > with you. Email me at [EMAIL PROTECTED] only, because
On Monday 18 February 2008 4:33 am, ItsMikeE wrote:
> For some time now I have been getting spams that look like
> "Hello! I am tired this evening. I am nice girl that would like to chat
> with you. Email me at [EMAIL PROTECTED] only, because I am using my friend's
> email to write this. To see my
On Mon, 2008-02-18 at 02:33 -0800, ItsMikeE wrote:
> For some time now I have been getting spams that look like
> "Hello! I am tired this evening. I am nice girl that would like to chat with
> you. Email me at [EMAIL PROTECTED] only, because I am using my friend's email
> to write this. To see m
27 matches
Mail list logo
