M>-----Original Message-----
M>From: Andreas Davour [mailto:[EMAIL PROTECTED]
M>Sent: 13 April 2005 21:23
M>Cc: users@spamassassin.apache.org
M>Subject: Need for a new rule?
M>
M>
M>The following message have many characteristics in common with much
M>spam I've been getting lately. It's about investments, often shares,
M>stock options or oil. One odd thing about those messages is that they
M>all, like the one quoted below, have the letter 'l' substituted for
M>the pipe character i.e. '|'.
M>
M>Are there any rule for this? Would one be hard do design? I haven't
M>seen anything about is in the documentation. OR, I haven't understood
M>what I've read...
M>
M>/Andreas
I have a couple of rules I have written to catch these spams, still catching
plenty right now but who knows how long for:-
body MS_Hide_Yahoo /(?: [EMAIL PROTECTED]|\@ yahoo.com\b)/i score MS_Hide_Yahoo
4.5 describe MS_Hide_Yahoo Attempt to hide yahoo email address
body __MS_Oil_Stock1 /\bo.l and gas\b/i
body __MS_Oil_Stock2 /(?:\b\(?EOGI|\b\(?MOGI|\b\(?TDCP|\b\(?MEGJ)/i
body __MS_Oil_Stock3 /(?:\bEmerson|\bmontana|\bAdeptrader|\bAtheletic)/i
uri __MS_Oil_Stock4 /http\:\/\/finance\.yahoo\.com/i
body __MS_Ins_Stock1
/(?:\bGRDX|\b3DIcon|\bConclusion|\binvestments?|\bmarket value)/i
body __MS_Ins_Stock2 /(?:\bPenny St.ck|\bBuy Low|\bCurrent Price)/i
body __MS_Ins_Stock3
/(?:jeff.[0-9]{1,[EMAIL PROTECTED]|\bst(?:0|o)cks?[0-9]{0,[EMAIL
PROTECTED]|\bNo Thanks)/i
body __MS_Ins_Stock4 /(?:\bst0ck|\bprice \$|\bdollars)/i
meta MS_Stock ((__MS_Oil_Stock1 + __MS_Oil_Stock2 + __MS_Oil_Stock3 +
__MS_Oil_Stock4 + __MS_Ins_Stock1 + __MS_Ins_Stock2 + __MS_Ins_Stock3 +
__MS_Ins_Stock4) > 2)
score MS_Stock 5.0
describe MS_Stock Investment Stock Spam
Make allowance for word-wrap, not sure how legible they will be.
Martin
