Re: Rule for this kind of spam?

2007-08-21 Thread John Andersen
On Monday 20 August 2007, Rob McEwen wrote: > In one of these cases, the message contains ONLY letters and numbers... all > other spaces, line breaks, and punctuation has been removed. Even > underscores are removed. Have you considered the opposite? Removing all letters, numbers and spaces, leavi

Re: Rule for this kind of spam?

2007-08-20 Thread John D. Hardin
On Mon, 20 Aug 2007, Rob McEwen wrote: > In one of these cases, the message contains ONLY letters and numbers... all > other spaces, line breaks, and punctuation has been removed. Even > underscores are removed. I also convert the message to lowercase. > Perhaps there is some equivalant functio

Re: Rule for this kind of spam?

2007-08-20 Thread Rob McEwen
Anyone have a rule that will kill this type of spam? H,E_R-E WE GO A'GAIN! T.H-E B'I'G O N*E BEFO RE T*H*E SEPTEMBE_+R.RALLY! T_H'E MAR KET IS A BOUT TO P'O-P_, A N D SO IS E,X+M*T,! As others have mentioned, chickenpox.cf. Available in the "other rules" section at rulesemporium. Here is a

Re: Rule for this kind of spam?

2007-08-20 Thread Loren Wilton
Anyone have a rule that will kill this type of spam? H,E_R-E WE GO A'GAIN! T.H-E B'I'G O N*E BEFO RE T*H*E SEPTEMBE_+R.RALLY! T_H'E MAR KET IS A BOUT TO P'O-P_, A N D SO IS E,X+M*T,! As others have mentioned, chickenpox.cf. Available in the "other rules" section at rulesemporium. Lo

Re: Rule for this

2005-11-22 Thread jdow
It would appear that you are hopelessly stuck, then. Trusted hosts has become a very important part of SA's activities. {^_^} - Original Message - From: "Casey King" <[EMAIL PROTECTED]> I do understand that the trusted hosts needs to be fixed, but not being fully in control, I am not

RE: Rule for this

2005-11-22 Thread Casey King
@spamassassin.apache.orgSubject: Re: Rule for this First, fix your trusted hosts.  You shoudln't be trusting a DSL line on some other system.   Second, you don't mention what version of SA you are using, nor what rules files you are using.  It looks like you don't have antidrug rules, wh

Re: Rule for this

2005-11-21 Thread Loren Wilton
Title: Message  First, fix your trusted hosts.  You shoudln't be trusting a DSL line on some other system.   Second, you don't mention what version of SA you are using, nor what rules files you are using.  It looks like you don't have antidrug rules, which would imply 2.6x.  In any case some

RE: Rule for this

2005-11-18 Thread Casey King
? -Original Message- From: Jean-Paul Natola [mailto:[EMAIL PROTECTED] Sent: Monday, November 14, 2005 2:50 PM To: Gene Heskett; users@spamassassin.apache.org Subject: RE: Rule for this ??-LINT On Monday 14 November 2005 11:22, Casey King wrote: >Okay, > >I have the rule in my local.cf a

RE: Rule for this ??-LINT

2005-11-15 Thread Pierre Thomson
Jean-Paul Natola wrote: > > > Hi all, I *believe* I have applied the following rule correctly, > > To verify I ran the --lint , it all checked out ok BUT its giving > some errors with respect to the whitelisted entries I have in the > local.cf that resides in the SA directory > > I know my whi

RE: Rule for this ??-LINT

2005-11-14 Thread Jean-Paul Natola
PEC_LEO_LINE06 >5.00 SARE_URI_EQUALS Trying to hide the real URL with IE parsing bug >0.00 UPPERCASE_25_50 message body is 25-50% uppercase > >-Original Message- >From: Pierre Thomson [mailto:[EMAIL PROTECTED] >Sent: Monday, November 14, 2005 9:19 AM >To: Casey King; SpamA

Re: Rule for this ??

2005-11-14 Thread Gene Heskett
LINE06 >5.00 SARE_URI_EQUALS Trying to hide the real URL with IE parsing bug >0.00 UPPERCASE_25_50 message body is 25-50% uppercase > >-Original Message- >From: Pierre Thomson [mailto:[EMAIL PROTECTED] >Sent: Monday, November 14, 2005 9:19 AM >To: Casey King; SpamA

RE: Rule for this ??

2005-11-14 Thread Casey King
9 AM To: Casey King; SpamAssassin Users Subject: RE: Rule for this ?? Casey King wrote: >> body L_DRUGS11 /([CVAXP] ){5}/ >> header L_DRUGS12 MESSAGEID =~ >> /^<[EMAIL PROTECTED]>/ >> meta L_DRUGS1 L_DRUGS11 && L_DRUGS12 >> score L_DRUGS1 5 >>

RE: Rule for this ??

2005-11-14 Thread Pierre Thomson
Casey King wrote: >> body L_DRUGS11 /([CVAXP] ){5}/ >> header L_DRUGS12 MESSAGEID =~ >> /^<[EMAIL PROTECTED]>/ >> meta L_DRUGS1 L_DRUGS11 && L_DRUGS12 >> score L_DRUGS1 5 >> describe L_DRUGS1 Strange Message-ID and Spam signature in body. > > This rule goes in the local.cf file right? I added thi

RE: Rule for this ??

2005-11-14 Thread Casey King
to '1' or '11'??? thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, November 14, 2005 3:01 AM To: [EMAIL PROTECTED]; users@spamassassin.apache.org Subject: RE: Rule for this ?? This one works like magic .. Also on the new va

RE: Rule for this ??

2005-11-14 Thread Rikhardur.EGILSSON
This one works like magic .. Also on the new variant which seems to have been released this weekend. body L_DRUGS11 /([CVAXP] ){5}/ header L_DRUGS12 MESSAGEID =~ /^<[EMAIL PROTECTED]>/ meta L_DRUGS1 L_DRUGS11 && L_DRUGS12 score L_DRUGS1 5 describe L_DRUGS1 Strange Message-ID and Spam signature i

Re: Rule for this ??

2005-11-11 Thread Matt Kettler
Jean-Paul Natola wrote: > Here’s an intelligent html coder > > > > I viewed the source of the code because I was curious as to how these > words flew right through my SA , > > > > You will note that if turned into plain text , he used a bunch of > tables and cells to produce the following;