> -----Original Message-----
> From: Ralf Guenthner
> Sent: Wednesday, November 19, 2003 12:08 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Rule for naughty words containing dots?
> 
> 
> Hi list
> 
> Recently I've seen an increase in spam mails like the one below.
> Using SA 2.60 with a spam threshold of 5 they are not tagged. Does
> anyone already have a rule for stuff like that?
>
> Thanks in advance
> Ralf G.
> 
> psasi oosxa kmemjitw qsjvq ddblplv
> Just take V.l.A.G.R.A.X-DS about 15 minutes to 20 minutes before you 
> plan to have s.e.x to: qurzlwivd jhvpnp oyipkhe ghuxpcsl 
> hcwcyfmrb aqwrg wvckryfm onuah ovogq imhanejw
> 
> a.. Have firmer e.r.e.c.t.lon
> a.. Enjoy s.e.x life better
> a.. F ulfil partner's s.e.x.ual needs
> a.. Bolster self confidence
> a.. Renew and strengthen s.e.x life
> a.. Restore lntlmacy
> a.. Solidify s.e.x.ual bonds
> umbbksdi fhamlawpd bzljkd wluhqh psoqty
> With V.l.A.G.R.A.X-DS optimal s.e.x.ual function can be restored for 
> nearly every man!
> vhnzxrvtz mnswymd vpgdipful fibkuck
> follow THIS LINK
> 
> V.l.A.G.R.A.X-DS? It is a cheap and more efficient V.l.A.G.R.A? 
> alternative. hphnakqj nojqzicqw grdwbcxcr ldbgnn jomhzckg



You could just modify the one used for G.a.p.p.y-T.e.x.t in the subject.
This would catch more than just period obfuscated text.  Score it
appropriately - meaning score it low to begin with and look for FPs.  Then
increase the score according to your needs/tolerances.

describe MY_GAPPY_BODY  MY: contains G.a.p.p.y-T.e.x.t
body     MY_GAPPY_BODY  /\b(?:[a-z][-_. ]{1,3}){4,}/i
score    MY_GAPPY_BODY  2.0

--Larry



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to