http://bugzilla.spamassassin.org/show_bug.cgi?id=2875
Summary: Two tests to match common spam
Product: Spamassassin
Version: 2.61
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P5
Component: Rules
AssignedTo: [EMAIL PROTECTED]
ReportedBy: [EMAIL PROTECTED]
These two rules work very well for me, currently no other spamassassin rules
give enough points for this kind of spam.
Maybe the first two tests are due to the used mailing software, which I did not
positively identify as ratware.
The third and last test is really only seen on spam by me.
full J_SPAM_HTML /<HTML><HEAD>\n<BODY>\n<p>/s
describe J_SPAM_HTML Typical ratware usage of HTML headers
score J_SPAM_HTML 2
full J_SPAM_HTML_2 /<HTML><HEAD>\n\n<\/HEAD>\n<BODY>\n\n <p>/s
describe J_SPAM_HTML_2 Typical ratware usage of HTML headers (2)
score J_SPAM_HTML_2 2
header J_SUBJ_ID Subject =~ /^Re: [A-Z]{3,10}, [a-z' ]{10,50}$/
describe J_SUBJ_ID Subj: "Re: CAPITALS, lowercase normal text"
score J_SUBJ_ID 2
Received: from unknown (HELO c-24-0-9-243.client.comcast.net) (24.0.9.243)
by pb2.pair.com with SMTP; 29 Dec 2003 10:04:03 -0000
Received: from [24.0.9.243] by 530000x.netIP with HTTP;
Mon, 29 Dec 2003 01:59:57 +0400
From: "Brewster Vince" <[EMAIL PROTECTED] >
To: [EMAIL PROTECTED]
Subject: Re: FYKMM, fence far from
Mime-Version: 1.0
X-Mailer: mPOP Web-Mail 2.19
X-Originating-IP: [530000x.netIP]
Date: Sun, 28 Dec 2003 23:01:57 +0100
Reply-To: "Brewster Vince" <[EMAIL PROTECTED] >
Content-Type: multipart/alternative;
boundary="--ALT--WJFS68409810618156"
Message-Id: <[EMAIL PROTECTED]>
----ALT--WJFS68409810618156
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
menopause tid choice magma abrasive postmortem
chairman downpour crabmeat gelatine
somersault polymer marjorie shun discus armistice cantaloupe authenticate
----ALT--WJFS68409810618156
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 8bit
<HTML><HEAD>
</HEAD>
<BODY>
<p>O</comprehend>ur U</smith>S Li</electoral>censed Doc</dredge>tors
wi</stretch>ll<BR>
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
