unsubscribe
On Wed, 2004-08-25 at 15:39, Loren Wilton wrote:
> >We are receiving in our server tons of Spam emails with Subjects like this:
>
> >M___crie as suas proprias estampas 391
>
> >As you can see, it has at least two underscore characters ( __ ) and I
> think this would be the only >way to scan them.
>
> You should have posted a complete spam, or at least complete headers. There
> probably are a lot more spam signs available in a typical spam.
>
> The concern I have with the rule you want is that it is likely to hit on a
> lot of ham messages as well as the spams you want to filter. Generally you
> should look for 2 or 3 things at least in a mail to filter it. For
> instance, there is a number at the end of that subject line. That is often
> typical of spam. Is there always only one letter before the two
> underscores? Is it always uppercase? Is it always 'M'? All of these would
> be good things to know.
>
> The specific rule you asked for would be written as
>
> header SUB_UNDERSCORES Subject =~ /__/
> score SUB_UNDERSCORES 0.1
>
> But don't use it, or at least not with any significant score.
>
> If I assume that the underscores always come in the middle of the first word
> of the subject, and the subject always ends with a number, I get:
>
> header US_SPAM Subject =~ /^\s*\w+__\w.{1,80}\s\d+\s*$/
> score US_SPAM 2.0
> describe US_SPAM Possible spam with a double underscore subject
>
> That might be a useful rule to try if you don't have anything better to
> filter on.
>
> Remember to restart spamd (if you are using it) after changing the rules
> file.
>
> Loren
--
Matt <[EMAIL PROTECTED]>
