http://bugzilla.spamassassin.org/show_bug.cgi?id=2875
------- Additional Comments From [EMAIL PROTECTED] 2003-12-31 03:59 -------
From my personal spam archive.
Note:
- In headers, it says: "Full Name <[EMAIL PROTECTED] >" (with a space before
the last >)
- Use of %RND_UC_CHAR[2-8], I suggest changing the '{3,10}' to a '+' in the
J_SUBJ_ID rule
- The X-Originating IP is unroutable and nonexistent (according to whois)
Since mPOP might have normal use, you cannot match for that, but you can match
for that strange space, for J_SUBJ_ID, and:
full J_OBFUSCATING_SGML /([^<>]*[^<> ]<\/[a-z]+>[^<> ]){3}/
describe J_OBFUSCATING_SGML Contains 3 successive mid-text SGML closing tags
score J_OBFUSCATING_SGML 2
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 1911 invoked from network); 20 Dec 2003 13:39:32 -0000
Received: from unknown (HELO 216.92.131.5) (61.177.183.229)
by pb2.pair.com with SMTP; 20 Dec 2003 13:39:32 -0000
Received: from [61.177.183.229] by 56.218.116.136 with HTTP;
Fri, 19 Dec 2003 21:31:18 -0400
From: "Fair Courtney" <[EMAIL PROTECTED] >
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
Subject: Re: %RND_UC_CHAR[2-8], was he drinking
Mime-Version: 1.0
X-Mailer: mPOP Web-Mail 2.19
X-Originating-IP: [196.56.86.173]
Date: Sat, 20 Dec 2003 00:36:18 -0100
Reply-To: "Fair Courtney" <[EMAIL PROTECTED] >
Content-Type: multipart/alternative;
boundary="--ALT--TKEQ09634790224014"
Message-Id: <[EMAIL PROTECTED]>
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
