Re: Rule Help - not sure what is wrong with my syntax

> header TO_SPECIFIC_DOMAIN To:addr =~ /\@(test\.com|test\.net)$/ That for efficiency really should use a non-capturing grouping: header TO_SPECIFIC_DOMAIN To:addr =~ /\@(?:test\.com|test\.net)$/ Note the "?:" after the left parend. Loren

Re: Rule Help - not sure what is wrong with my syntax

David B Funk skrev den 2023-01-14 08:35: On Sat, 14 Jan 2023, Benny Pedersen wrote: Benny Pedersen skrev den 2023-01-14 03:59: header TO_SPECIFIC_DOMAIN To:addr =~ /\@(test|junc)\.(com|net|eu)$/ describe TO_SPECIFIC_DOMAIN Mail sent to test.com or test.net email addresses score TO_SPECIFIC_D

Re: Rule Help - not sure what is wrong with my syntax

On Sat, 14 Jan 2023, Benny Pedersen wrote: Benny Pedersen skrev den 2023-01-14 03:59: header TO_SPECIFIC_DOMAIN To:addr =~ /\@(test|junc)\.(com|net|eu)$/ describe TO_SPECIFIC_DOMAIN Mail sent to test.com or test.net email addresses score TO_SPECIFIC_DOMAIN -0.5 tested works if i mail myself :=

Re: Rule Help - not sure what is wrong with my syntax

Benny Pedersen skrev den 2023-01-14 03:59: header TO_SPECIFIC_DOMAIN To:addr =~ /\@(test|junc)\.(com|net|eu)$/ describe TO_SPECIFIC_DOMAIN Mail sent to test.com or test.net email addresses score TO_SPECIFIC_DOMAIN -0.5 tested works if i mail myself :=)

Re: Rule Help - not sure what is wrong with my syntax

Joey J skrev den 2023-01-14 03:42: header TO_SPECIFIC_DOMAIN To:addr =~ /\@(test\.com|test\.net)$/ describe TO_SPECIFIC_DOMAIN Mail sent to test.com or test.net email addresses score TO_SPECIFIC_DOMAIN -2.0 header TO_SPECIFIC_DOMAIN To:addr ~= /\@test\.(com|net)$/ should work

Re: Rule Help - not sure what is wrong with my syntax

Thanks to everyone's suggestions. I will try to respond to everyone in this 1 message: This was intended for people who get both filtering inbound and outbound form the mail gateway. At times certain legit content gets flagged on the way OUT, so this was to try and add a little negative score, so

Re: Rule Help - not sure what is wrong with my syntax

On Thu, 12 Jan 2023, John Hardin wrote: On Thu, 12 Jan 2023, Martin Gregorie wrote: On Wed, 2023-01-11 at 18:39 -0500, Joey J wrote: Hello All, I created this rule to check for email addresses matching a list to get added some negative value. I also tried it with just domains so it wou

Re: Rule Help - not sure what is wrong with my syntax

On Thu, 12 Jan 2023, Martin Gregorie wrote: On Wed, 2023-01-11 at 18:39 -0500, Joey J wrote: Hello All, I created this rule to check for email addresses matching a list to get added some negative value. I also tried it with just domains so it would be more efficient, but I can't seem to get th

Re: Rule Help - not sure what is wrong with my syntax

2\.com | > example3\.com)$' > > > Loren > > - Original Message - > From: [4]Joey J > To: [5]users@spamassassin.apache.org > Sent: Wednesday, January 11, 2023 3:39 PM > Subject: Rule Help - not sure what is wrong with my syntax

Re: Rule Help - not sure what is wrong with my syntax

On Wed, 2023-01-11 at 16:56 -0800, Loren Wilton wrote: > Why not do a simple rule rather than inventing some Perl code? > > header TO_SPECIFIC_EMAIL To:addr ~= > '(?:\bus...@example.com|\bus...@example.com|\bus...@example.com)' > describe TO_SPECIFIC_EMAIL Mail to a specific email address > score

Re: Rule Help - not sure what is wrong with my syntax

On Wed, 2023-01-11 at 18:39 -0500, Joey J wrote: > Hello All, > > I created this rule to check for email addresses matching a list to > get > added some negative value. > I also tried it with just domains so it would be more efficient, but I > can't seem to get them to run. > Any suggestions? > U

Re: Rule Help - not sure what is wrong with my syntax

Original Message - From: Joey J To: users@spamassassin.apache.org Sent: Wednesday, January 11, 2023 3:39 PM Subject: Rule Help - not sure what is wrong with my syntax Hello All, I created this rule to check for email addresses matching a list to get added some negative

Rule Help - not sure what is wrong with my syntax

Hello All, I created this rule to check for email addresses matching a list to get added some negative value. I also tried it with just domains so it would be more efficient, but I can't seem to get them to run. Any suggestions? header TO_SPECIFIC_EMAIL eval:check_to_specific_email() describe TO_

Re: Custom rule help

On Wed, 4 Dec 2019 12:40:27 -0800 Chris Mulcahy wrote: > Hi. > > I’m relatively new to complex custom rules. I have plenty of simple > and some multi-condition rules but need something custom. > > My approach to using my domain name is bad but I started it in the > 90s so… I have some sites where

Re: Custom rule help

On Wed, 4 Dec 2019 12:40:27 -0800 Chris Mulcahy wrote: > Hi. > > I’m relatively new to complex custom rules. I have plenty of simple > and some multi-condition rules but need something custom. > > My approach to using my domain name is bad but I started it in the > 90s so… I have some sites whe

Re: Custom rule help

On Wed, 2019-12-04 at 14:22 -0800, Chris Mulcahy wrote: > Actually, I want it to score if there ISN’T a match. If I get an email > addressed to slashdot@example.com from an address that isn’t from > slashdot, it’s likely spam. > > Currently, I am doing like you mentioned with a bunch of indivi

Re: Custom rule help

From: Martin Gregorie Reply: mar...@gregorie.org Date: December 4, 2019 at 4:12:22 PM To: users@spamassassin.apache.org Subject: Re: Custom rule help On Wed, 2019-12-04 at 12:40 -0800, Chris Mulcahy wrote: > I want a rule that scores if “sitename” is not in the From: line. If > the

Re: Custom rule help

On Wed, 2019-12-04 at 12:40 -0800, Chris Mulcahy wrote: > I want a rule that scores if “sitename” is not in the From: line. If > they send from i...@sitename.com, I’ll assume it’s legit. If sitename > does not exist, I’ll tick up the score a bit. I have done this for > some specific domains but th

Custom rule help

Hi. I’m relatively new to complex custom rules. I have plenty of simple and some multi-condition rules but need something custom. My approach to using my domain name is bad but I started it in the 90s so… I have some sites where I gave them my email address as “ sitename@mydomain.com” so I

Re: Rule Help

At 03:31 PM 9/26/2015, jdow wrote: On 2015-09-26 07:12, RW wrote: On Fri, 25 Sep 2015 10:28:42 -0400 Dianne Skoll wrote: On Fri, 25 Sep 2015 14:21:50 + Dave wrote: I am trying to create a rule that scores TLD's in received headers if they are not certain TLD's. What I have so far: You

Re: Rule Help

At 03:31 PM 9/26/2015, jdow wrote: On 2015-09-26 07:12, RW wrote: On Fri, 25 Sep 2015 10:28:42 -0400 Dianne Skoll wrote: On Fri, 25 Sep 2015 14:21:50 + Dave wrote: I am trying to create a rule that scores TLD's in received headers if they are not certain TLD's. What I have so far: You

Re: Rule Help

On 2015-09-26 07:12, RW wrote: On Fri, 25 Sep 2015 10:28:42 -0400 Dianne Skoll wrote: On Fri, 25 Sep 2015 14:21:50 + Dave wrote: I am trying to create a rule that scores TLD's in received headers if they are not certain TLD's. What I have so far: Your logic is wrong. And you can do it

Re: Rule Help

On Fri, 25 Sep 2015 10:28:42 -0400 Dianne Skoll wrote: > On Fri, 25 Sep 2015 14:21:50 + > Dave wrote: > > > I am trying to create a rule that scores TLD's in received headers > > if they are not certain TLD's. What I have so far: > > Your logic is wrong. And you can do it all with one rege

Re: Rule Help

On 9/25/2015 10:28 AM, Dianne Skoll wrote: On Fri, 25 Sep 2015 14:21:50 + Dave wrote: I am trying to create a rule that scores TLD's in received headers if they are not certain TLD's. What I have so far: Your logic is wrong. And you can do it all with one regex: header GC_TLD_COM Receiv

Re: Rule Help

On Fri, 25 Sep 2015 14:21:50 + Dave wrote: > I am trying to create a rule that scores TLD's in received headers if > they are not certain TLD's. What I have so far: Your logic is wrong. And you can do it all with one regex: header GC_TLD_COM Received !~/\.(?:com|net|org|edu|uk)\b/i I won'

Rule Help

I am trying to create a rule that scores TLD's in received headers if they are not certain TLD's. What I have so far: header __GC_TLD_com Received !~ /\.com\b/i header __GC_TLD_net Received !~ /\.net\b/i header __GC_TLD_org Received !~ /\.org\b/i header __GC_TLD_edu Received !~ /\.edu\b/i heade

Re: Rule Help

On Wed, 28 May 2014, Rejaine Monteiro wrote: So, I doing this: header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i body __ORCAMENTO_B /or.*amento|planilha|urgente/i ...is redundant. The subject text is included in body rules. -- John Hardin KA7OHZhttp://www.im

Re: Rule Help

On 5/28/2014 11:14 AM, Martin Gregorie wrote: On Wed, 2014-05-28 at 10:19 -0300, Rejaine Monteiro wrote: So, I doing this: header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i body __ORCAMENTO_B /or.*amento|planilha|urgente/i uri __ORCAMENTO_U /orcamento\.php|/orcamento\.pdf|planilha\

Re: Rule Help

In fact, there was this error, even after fixing it still didn't work. I believe that the problem was occurring because the message had a HMTL attached and in turn had a link to the file. I decided to change and do as follows: header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i bod

Re: Rule Help

On 5/28/2014 9:19 AM, Rejaine Monteiro wrote: Hi I need a rule to block spam contains Subject or Body contains words 'or.*amento' or 'planilha' or 'urgente' AND URI contains links to orcamento or panilha (php or pdf) So, I doing this: header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgent

Rule Help

Hi I need a rule to block spam contains Subject or Body contains words 'or.*amento' or 'planilha' or 'urgente' AND URI contains links to orcamento or panilha (php or pdf) So, I doing this: header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i body __ORCAMENTO_B /or.*amento|planilha|u

Re: Debugging rule help

On 1/11/2014 9:05 AM, Alex wrote: Hi, On Fri, Jan 10, 2014 at 10:32 PM, Kevin A. McGrail > wrote: I checked in basic and I didn't get very far just looking at the first rule using your pastebin example. It didn't appear to hit your rules. Might be s

Re: Debugging rule help

Hi, On Fri, Jan 10, 2014 at 10:32 PM, Kevin A. McGrail wrote: > I checked in basic and I didn't get very far just looking at the first > rule using your pastebin example. It didn't appear to hit your rules. > > Might be something lost via pastebin but it's late and I'm tired so could > be my mi

Re: Debugging rule help

I checked in basic and I didn't get very far just looking at the first rule using your pastebin example.  It didn't appear to hit your rules. Might be something lost via pastebin but it's late and I'm tired so could be my mistake as well. However, spamassas

Debugging rule help

HI, I have an FP that has hit on a few rules, but one of them was a rule for short URLs, but I can't figure out which one it's hitting. How can I have it show me which pattern triggered a specific rule? It seems some rules already show this, for example: Jan 10 19:38:29.919 [2393] dbg: rules: ra

Re: Regex Rule Help?

On 03/21/2011 10:07 AM, Terry Carmen wrote: > I'm trying to match any URL that points to a URL shortener. > > They typically consist of http(s) followed by a domain name, > a slash and a small series of alphanumeric characters, > *without a trailing "/" or file extension*. > > I seem to be having

Re: Regex Rule Help?

On Mon, 2011-03-21 at 13:07 -0400, Terry Carmen wrote: > I'm trying to match any URL that points to a URL shortener. > > They typically consist of http(s) followed by a domain name, a slash > and a small series of alphanumeric characters, *without a trailing "/" > or file extension*. > > I se

Re: Regex Rule Help?

On 3/21/2011 1:07 PM, Terry Carmen wrote: > I'm trying to match any URL that points to a URL shortener. > > They typically consist of http(s) followed by a domain name, a slash > and a small series of alphanumeric characters, *without a trailing "/" > or file extension*. > > I seem to be having pre

Regex Rule Help?

I'm trying to match any URL that points to a URL shortener. They typically consist of http(s) followed by a domain name, a slash and a small series of alphanumeric characters, *without a trailing "/" or file extension*. I seem to be having pretty good luck matching the URL, however I can't

Re: custom rule help

On 2010/11/24 02:55 PM, John Wilcock wrote: Le 24/11/2010 09:50, Tom Kinghorn a écrit : By default, header rules work on the *decoded* subject, not the raw quoted-printable-encoded subject you've quoted. So you need to replace the underscores with spaces in your regex. Alternatively (though

Re: custom rule help

Le 24/11/2010 09:50, Tom Kinghorn a écrit : Subject: =?windows-1252?Q?100%_Finance_with_No_Deposit_Required_:_Stands_in_a_Pristine_West_Coast_Beachside_Security_Village?= I would like to match _Stands_in_a_Pristine_West_Coast_Beachside_Security_Village By default, header rules work on the *de

Re: custom rule help

On Wed, 2010-11-24 at 10:50 +0200, Tom Kinghorn wrote: > My last attempt was: > > header VM_WESTCOAST_SUB Subject =~ > /.*:_Stands_in_a_Pristine_West_Coast_Beachside_Security_Village/ > > any help would be appreciated. > How are you testing your rules? If you want to test and/or deve

RE: custom rule help

el: 01432 260160 From: Tom Kinghorn [mailto:thomas.kingh...@gmail.com] Sent: 24 November 2010 08:51 To: users@spamassassin.apache.org Subject: custom rule help Morning List. Firstly, apologies for posting this here. I have tried dozens of times to get this rule working, without success. I need t

custom rule help

Morning List. Firstly, apologies for posting this here. I have tried dozens of times to get this rule working, without success. I need to write a custom rule to score a message Subject. Subject: =?windows-1252?Q?100%_Finance_with_No_Deposit_Required_:_Stands_in_a_Pristine_West_Coast_Beachside

Re: Freemail Rule help

John Hardin wrote: On Tue, 6 Apr 2010, Ned Slider wrote: John Hardin wrote: On Tue, 6 Apr 2010, Ned Slider wrote: > uriLOCAL_URI_BITLY m{https?://bit\.ly/\w{6}} > describe LOCAL_URI_BITLY contains bit.ly link bit.ly is a legitimate URL-shortening service. Are you sure

Re: Freemail Rule help

On Tue, 6 Apr 2010, Alex wrote: uriLOCAL_URI_BITLYm{https?://bit\.ly/\w{6}} For the time-being, I have Ned's suggestion in place over mine because mine has problems,. along with additional qualifiers (such as FREEMAIL_FROM) to further reduce the FPs. Other suggestions welcome...

Re: Freemail Rule help

Hi, >> uri             LOCAL_URI_BITLY         m{https?://bit\.ly/\w{6}} >> describe        LOCAL_URI_BITLY         contains bit.ly link > > bit.ly is a legitimate URL-shortening service. Are you sure you want to > penalize them? Yes, I don't at all like to do this, but it doesn't take too many o

Re: Freemail Rule help

On Tue, 6 Apr 2010, Ned Slider wrote: John Hardin wrote: On Tue, 6 Apr 2010, Ned Slider wrote: > uriLOCAL_URI_BITLY m{https?://bit\.ly/\w{6}} > describe LOCAL_URI_BITLY contains bit.ly link bit.ly is a legitimate URL-shortening service. Are you sure you want to penali

Re: Freemail Rule help

John Hardin wrote: On Tue, 6 Apr 2010, Ned Slider wrote: uriLOCAL_URI_BITLYm{https?://bit\.ly/\w{6}} describeLOCAL_URI_BITLYcontains bit.ly link bit.ly is a legitimate URL-shortening service. Are you sure you want to penalize them? As I said, I use that rule i

Re: Freemail Rule help

On Tue, 6 Apr 2010, Ned Slider wrote: uri LOCAL_URI_BITLY m{https?://bit\.ly/\w{6}} describeLOCAL_URI_BITLY contains bit.ly link bit.ly is a legitimate URL-shortening service. Are you sure you want to penalize them? -- John Hardin KA7OHZ

Re: Freemail Rule help

Alex wrote: Hi, I'm having a problem with emails that are from a freemail domain with simply a shorturl in them, like this: http://bit.ly/aqI4o1>http://bit.ly/aqI4o1/Benjaminlovee ya rawbodyLOC_BITLY /href\=http:\/\/bit\.ly\/.+\w{1,8}>http:\/\/bit\.ly\/.+\w{1,15}\/.+\w{1,15}<\/a>/ Is this

Freemail Rule help

Hi, I'm having a problem with emails that are from a freemail domain with simply a shorturl in them, like this: http://bit.ly/aqI4o1>http://bit.ly/aqI4o1/Benjaminlovee ya rawbodyLOC_BITLY /href\=http:\/\/bit\.ly\/.+\w{1,8}>http:\/\/bit\.ly\/.+\w{1,15}\/.+\w{1,15}<\/a>/ Is this the most effe

Re: Rule help

Hi, >> If so, can I pull the messages out, unlearn them, then re-learn them >> as spam instead? > > I don't think this makes sense. You don't know which messages biased your > db in the wrong way. It's better to start over. Bayes has such a substantial role in the messages that get tagged, I coul

Re: Rule help

On Sat, 06 Mar 2010 16:31:21 +0100 Kai Schaetzl wrote: > Rw wrote on Sat, 6 Mar 2010 14:20:15 +: > > > I mean that a similar spam from the same spammer that's not been > > learned will hit 50. > > That depends on your definition of "similar". If it doesn't score > it's not "similar". they

Re: Rule help

I trigger on the X-Originating-IP header. You'll probably want to do 64.72.123 and 64.72.124 also. Sample rule: header TBI_HOTMAIL_IP9X-Originating-IP =~ /\[(83\.37\.86\.|189\.156\.198\.|190\.78\.95\.|189\.111\.56\.|125\.163\.120\.|115\.118\.23\.|123\.201\.175\.|64\.72\.122\.|83\.

Re: Rule help

Rw wrote on Sat, 6 Mar 2010 14:20:15 +: > I mean that a similar spam from the same spammer that's not been > learned will hit 50. That depends on your definition of "similar". If it doesn't score it's not "similar". Anyway, as I said I interpreted his remark as doing some testing right aft

Re: Rule help

On Sat, 06 Mar 2010 11:31:17 +0100 Kai Schaetzl wrote: > Rw wrote on Sat, 6 Mar 2010 01:04:20 +: > > > There's nothing odd about that, it's common that hard to learn spam > > is identified correctly on retesting. > > I'm not sure what you want to say. Do you want to say that a message > tes

Re: Rule help

Alex wrote on Fri, 5 Mar 2010 21:55:35 -0500: > However, > searching through the quarantine to see how many with a similar > pattern have been caught, I see there are a large number of emails > with BAYES_00. Is this a sure sign of a problem with bayes? Maybe. > If so, can I pull the messages ou

Re: Rule help

Rw wrote on Sat, 6 Mar 2010 01:04:20 +: > There's nothing odd about that, it's common that hard to learn spam is > identified correctly on retesting. I'm not sure what you want to say. Do you want to say that a message tested right after learning may get 99, but next day it will have 50 aga

Re: Rule help

Hi, > As Kai said, check your Bayes is actually working. I've been seeing dozens > of these daily for what seems like ages, and Bayes now has no trouble > nailing them although it understandably missed them when they first started > arriving. If I try to learn the same message again, sa-learn say

Re: Rule help

On Fri, 05 Mar 2010 18:39:25 +0100 Kai Schaetzl wrote: > Alex wrote on Fri, 5 Mar 2010 11:02:35 -0500: > > > I've trained probably 50 of these, yet they still have BAYES_50. > > I trained your example and it went from 50 to 99. With *1* message! > There may be something wrong with your Bayes. W

Re: Rule help

On 2010-03-05 14:51, Henrik K wrote: On Fri, Mar 05, 2010 at 11:02:35AM -0500, Alex wrote: Hi all, I'm having trouble with an elusive spam for the past few days with just "re" in the subject. It looks to be routed through hotmail.com, but doesn't have an SPF signature, so I don't really underst

Re: Rule help

On Fri, Mar 05, 2010 at 11:02:35AM -0500, Alex wrote: > Hi all, > > I'm having trouble with an elusive spam for the past few days with > just "re" in the subject. It looks to be routed through hotmail.com, > but doesn't have an SPF signature, so I don't really understand. > Here's an example: > >

Re: Rule help

Alex wrote: Hi all, I'm having trouble with an elusive spam for the past few days with just "re" in the subject. It looks to be routed through hotmail.com, but doesn't have an SPF signature, so I don't really understand. SPF doesn't sign anything (perhaps you are thinking of dkim), and anyway

Re: Rule help

Alex wrote on Fri, 5 Mar 2010 11:02:35 -0500: > I've trained probably 50 of these, yet they still have BAYES_50. I trained your example and it went from 50 to 99. With *1* message! There may be something wrong with your Bayes. With 400.000 tokens in the db. Why did you replace the @? And please

Rule help

Hi all, I'm having trouble with an elusive spam for the past few days with just "re" in the subject. It looks to be routed through hotmail.com, but doesn't have an SPF signature, so I don't really understand. Here's an example: http://pastebin.com/Lg63Xek4 I've trained probably 50 of these, yet

Re: SA Rule help question

On Fri, 30 Oct 2009, Rose, Bobby wrote: Does anyone know how a rule can be written to compare two header markers for similar info? Take a look at MAILER_EQ_ORG here: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?view=log -- John Hardin KA7OHZ

SA Rule help question

Does anyone know how a rule can be written to compare two header markers for similar info? I don't think SA can do variable storage so I was thinking maybe a regex rule that normalizes what I want to focus on from a header in the regex search of another header. For example, let's say that I wa

Re: Rule help needed

Man, I wish I'd tried asking my question here a LONG time ago. You guys have been so helpful! Thanks a ton! You rock! -- View this message in context: http://www.nabble.com/Rule-help-needed-tf2260084.html#a6287909 Sent from the SpamAssassin - Users forum at Nabble.com.

Re: Rule help needed

ith: > > To =~ /\b(?:uucp|majordomo|root)[EMAIL PROTECTED]/i > > > Loren > > > -- View this message in context: http://www.nabble.com/Rule-help-needed-tf2260084.html#a6287888 Sent from the SpamAssassin - Users forum at Nabble.com.

Re: Rule help needed

From: "Theo Van Dinter" <[EMAIL PROTECTED]> On Tue, Sep 12, 2006 at 08:47:19PM -0700, jdow wrote: I've been contemplating that to a degree. It would be nice if I could use the standard rule paths and designate one extra directory for included rules from it. Then I could run, for a two user insta

Re: Rule help needed

On Tue, Sep 12, 2006 at 08:47:19PM -0700, jdow wrote: > I've been contemplating that to a degree. It would be nice if I could > use the standard rule paths and designate one extra directory for > included rules from it. Then I could run, for a two user installation, > a pair of spamd processes with

Re: Rule help needed

From: "Theo Van Dinter" <[EMAIL PROTECTED]> It's also worth noting that allow_user_rules makes spamd less efficient, at a minimum because it has to rebuild all of the rule eval strings for every message. IMO, don't enable allow_user_rules unless you really need to do it. I've been contemplati

Re: Rule help needed

On Tue, Sep 12, 2006 at 11:24:37PM -0400, Matt Kettler wrote: > might discover and publish and exploit for. Keeping allow_user_rules off > protects you from future exploits in this area if you have untrusted users. It's also worth noting that allow_user_rules makes spamd less efficient, at a minim

Re: Rule help needed

Bowie Bailey wrote: > kavaXtreme wrote: > >> I've read and read and read till my mind feels like spaghetti puree. >> I'm really hoping someone here can help with my question. >> >> My main question is, why doesn't the following rule work: >> header ROMPE_BADRECIPS To =~ /(uucp|majordomo|ro

Re: Rule help needed

header ROMPE_BADRECIPS To =~ /(uucp|majordomo|root)[EMAIL PROTECTED]/i Bowie has answered your questions. A couple of comments on the regex above. You should be using (?: instead of just ( to introduce the group. Without the ?: it is a capturing group that will capture the text found.

RE: Rule help needed

Bowie Bailey wrote: > kavaXtreme wrote: > > I've read and read and read till my mind feels like spaghetti puree. > > I'm really hoping someone here can help with my question. > > > > My main question is, why doesn't the following rule work: > > header ROMPE_BADRECIPS To =~ > > /(uucp|majordo

RE: Rule help needed

kavaXtreme wrote: > I've read and read and read till my mind feels like spaghetti puree. > I'm really hoping someone here can help with my question. > > My main question is, why doesn't the following rule work: > header ROMPE_BADRECIPS To =~ /(uucp|majordomo|root)[EMAIL PROTECTED]/i > score

Rule help needed

ow? If you are able to help, you have my thanks in advance! -- View this message in context: http://www.nabble.com/Rule-help-needed-tf2260084.html#a6270175 Sent from the SpamAssassin - Users forum at Nabble.com.

Re: Rule help ... if one rule matched, ignore another

mouss wrote: David Gibbs wrote: Folks: [...] My particular example ... I want to create a rule that will assign a specific score if the subject contains the word 'euromillion', but have a lower score if the subject contains 'million'. Obviously if I put two separate rules with the 'euromil

Re: Rule help ... if one rule matched, ignore another

David Gibbs wrote: Folks: I'm trying to create a rule that are basically exclusive of each other. That is ... if rule 1 is matched, then ignore rule 2. My particular example ... I want to create a rule that will assign a specific score if the subject contains the word 'euromillion', but have

Rule help ... if one rule matched, ignore another

Folks: I'm trying to create a rule that are basically exclusive of each other. That is ... if rule 1 is matched, then ignore rule 2. My particular example ... I want to create a rule that will assign a specific score if the subject contains the word 'euromillion', but have a lower score if the

Re: Rule Help

On Sat, Jan 21, 2006 at 02:17:50PM -0600, Rob Poe wrote: > I need a custom rule that looks for > X-Status: F > In the header, and adds a value to the score. (i.e. 2.5) > If anyone has some direction .. :) header X_STATUS_F X-Status =~ /^F$/ score X_STATUS_F 2.5 -- Randomly Generated Tagl

Rule Help

I need a custom rule that looks for X-Status: F In the header, and adds a value to the score. (i.e. 2.5) If anyone has some direction .. :) thanks! CONFIDENTIALITY NOTICE This e-mail message and all documents that

Re[2]: geocities.yahoo.com.br rule help

Hello Jonathan, Thursday, December 15, 2005, 11:12:23 AM, you wrote: >> Have you tried the 70_sare_specific.cf filter? I am not sure it will catch >> that specific problem but it catches spam with geocities and tripod url's for >> me. JN> Yeah, I'm using that list. It's been great, but the *.b

Re: geocities.yahoo.com.br rule help

Try this regex instead: /^http:\/\/geocities\.yahoo\.com\.br\b/i hahaha, this worked - and it tagged that broken autoresponder we've been seeing. boundary="--=ce94da72-0632-49d0-99bb-3f8c8149300b" X-Virus-Scanned: by amavisd-new at mailgate.pbp.net X-Spam-Status: Yes, score=9.704 t

Re: geocities.yahoo.com.br rule help

Jonathan Nichols wrote: Have you tried the 70_sare_specific.cf filter? I am not sure it will catch that specific problem but it catches spam with geocities and tripod url's for me. Yeah, I'm using that list. It's been great, but the *.br one kept getting through. I DID see THIS in there,

Re: geocities.yahoo.com.br rule help

Jonathan Nichols wrote: > >> >> But that's not the format, there's nothing between the / and the >> geocities. >> >> Try this regex instead: >> >> /^http:\/\/geocities\.yahoo\.com\.br\b/i > > > Cool, I shall try that. Thanks! For some reason, I thought one had > www.geocities.yahoo.com.br in it,

Re: geocities.yahoo.com.br rule help

Jonathan Nichols wrote: But that's not the format, there's nothing between the / and the geocities. Try this regex instead: /^http:\/\/geocities\.yahoo\.com\.br\b/i Cool, I shall try that. Thanks! For some reason, I thought one had www.geocities.yahoo.com.br in it, but I could be mistak

Re: geocities.yahoo.com.br rule help

But that's not the format, there's nothing between the / and the geocities. Try this regex instead: /^http:\/\/geocities\.yahoo\.com\.br\b/i Cool, I shall try that. Thanks! For some reason, I thought one had www.geocities.yahoo.com.br in it, but I could be mistaken.

Re: geocities.yahoo.com.br rule help

Have you tried the 70_sare_specific.cf filter? I am not sure it will catch that specific problem but it catches spam with geocities and tripod url's for me. Yeah, I'm using that list. It's been great, but the *.br one kept getting through. I DID see THIS in there, though.. headerSARE

Re: geocities.yahoo.com.br rule help

On 12/15/2005 06:09 pm, Jonathan Nichols wrote: > Ok, I gave it a shot.. > > This rule *does* work. > > uri GEOCITIES /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i > describe GEOCITIESHigh amounts of spam from Geocities. > score GEOCITIES 6.01 > Have you tried the 70_sare_sp

Re: geocities.yahoo.com.br rule help

Matt Kettler wrote: Jonathan Nichols wrote: Ok, I gave it a shot.. This rule *does* work. uri GEOCITIES /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i describe GEOCITIESHigh amounts of spam from Geocities. score GEOCITIES 6.01 This rule does NOT work. uri GEOCITIES_YAH

Re: geocities.yahoo.com.br rule help

Jonathan Nichols wrote: > Ok, I gave it a shot.. > > This rule *does* work. > > uri GEOCITIES /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i > describe GEOCITIESHigh amounts of spam from Geocities. > score GEOCITIES 6.01 > > > This rule does NOT work. > > uri GEOCITIES_YAH

geocities.yahoo.com.br rule help

Ok, I gave it a shot.. This rule *does* work. uri GEOCITIES /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i describe GEOCITIESHigh amounts of spam from Geocities. score GEOCITIES 6.01 This rule does NOT work. uri GEOCITIES_YAHOO /^http:\/\/[a-z0-9-]{1,30}\.geocities\.yaho

Re: SARE stock ruleset? (Re: custom rule help)

Wolfgang Zeikat wrote: SARE is about to release a stock ruleset. Looks really good. I was going to work on one, Then I saw the ninjas have it under control, and I'm just sitting back and watching the fun. Not sure on the release date. GO, ninjas, GO! Any news when that one is going to be av

SARE stock ruleset? (Re: custom rule help)

On 10/20/05 17:57, Chris Santerre wrote: Company: Symbol: Price: SARE is about to release a stock ruleset. Looks really good. I was going to work on one, Then I saw the ninjas have it under control, and I'm just sitting back and watching the fun. Not sure on the release date. GO, ninjas

Re: custom rule help

On Thursday 20 October 2005 08:39 am, Jean-Paul Natola wrote: > I've been getting quite a few messages sneaking in related to stocks, > What I have noticed is that they ALL contain the following; > > Company: > Symbol: > Price: > How would I go about a creating a rule/filter that would score any me

RE: custom rule help

> -Original Message- > From: Jean-Paul Natola [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 20, 2005 10:40 AM > To: users@spamassassin.apache.org > Subject: custom rule help > > > Hi all , > > I've been getting quite a few messages sneaking i

Re: custom rule help

Jean-Paul Natola wrote: > Hi all , > > I've been getting quite a few messages sneaking in related to stocks, > What I have noticed is that they ALL contain the following; > > Company: > Symbol: > Price: > How would I go about a creating a rule/filter that would score any message > that contain

  1   2   >