How about "70_sare_header.cf" and "99_OBFU_drugs.cf"? Slap it down GOOD.
{^_-}
----- Original Message -----
From: "Thomas Deliduka" <[EMAIL PROTECTED]>
Perhaps someone on the list can give me a suggestion then. Here is 5
e-mails
and how the subject line is done. (different every time) perhaps a pattern
can be found that I haven't found?
Subject: =?iso-8859-1?Q?G=D4od_pro_CI=C2IS_VI=E1GRRA?=
Subject: =?iso-8859-1?Q?Go=F6d_offr_C=EFAIS_VI=E3GRRA?=
Subject: V pr=?ISO-8859-1?Q?=F3per_C=CCAIS_V=CCAGRRA?=
Subject: V with y=?ISO-8859-1?Q?=F3u_CIA=ECS_VI=C5GRRA?=
Subject: Works G=?ISO-8859-1?Q?=D4od_CIA=ECS_VIAGRR=E2?=
If I were to venture a guess:
/\?iso\-8859\-1\?.*(CI|C).*(VI)?(GR+A|GR).*\?=/i
What do you think of that?
On 8/26/05 1:39 PM this was written:
From: "Kris Deugau" <[EMAIL PROTECTED]>
Thomas Deliduka wrote:
I have been dealing with a spammer that seems to defy every option to
limit him. So, I decided to create a final rule that should kill him.
I noticed that the subject in the text file always looks like
=3D?iso-8859-1?blah blha blah
It may or may not have 3D sometimes it's P3 or something so I made a
subject rule like this in my /etc/mail/spamassassin/local.cf:
header L_ISO_SUBJECT Subject =~ /iso\-8859\-/i
describe L_ISO_SUBJECT Last Ditch Attempt against this Arse
score L_ISO_SUBJECT 5.2
But I see a TON of e-mails that come through with a subject line like
that above and none of them are trapped by L_ISO_SUBJECT none!
Why would this be.
You want to use Subject:raw, so as to run your rule on the raw ASCII
subject line. What you're testing there is the *decoded* Subject: which
naturally has no encoding specification in it.
header L_ISO_SUBJECT Subject:raw =~ /iso\-8859\-/i
should work for what you're trying to do.
If I get that annoyed, I usually just save myself some processing time
and stuff in a procmail rule instead of playing with SA.
-kgd
Off hand I'd say that was a very bad rule. I receive a fair amount of
mail with that header that is quite positively ham. It's almost all
from Linux related lists.
--
Thomas Deliduka
Chief Technology Officer
-------------------------
Xenocast
Street Smart Media Solutions
http://www.xenocast.com/
