Thank you for that hint, however I still only get about 50% hit on such messages.
Using the rule Mr -=W=- ( :-) ) provided, and rewriting it to : header LOCAL_RX_SUBJECT Subject =~ /[a-z](RX)[a-z]/ I feel confident that this rule will not cause false positives. The Subject must contain RX with one letter on each side non-capital. The subject is always something like : paRXhu oaRXmy xyRXda I still however only add 5 points (required 6 for subject rewriting), theese mails are always in some of the SARE rules causing two or three points. Regards Paul On Tuesday 29 August 2006 21:28, John D. Hardin wrote: > On Tue, 29 Aug 2006, Paul Tenfjord wrote: > > I am using the following SARE rulesets : > > TRUSTED_RULESETS="SARE_STOCKS TRIPWIRE SARE_ADULT SARE_OBFU0 SARE_OBFU1 > > SARE_URI0 SARE_URI1 SARE_REDIRECT_POST300 SARE_SPECIFIC SARE_FRAUD > > SARE_OEM" They have not once detected this type of spam, do have a set > > that actually do? > > You might try the GENLSUBJ sets. GENLSUBJ0 has some "RX" rules. > > -- > John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/ > [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] > key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > ----------------------------------------------------------------------- > The difference is that Unix has had thirty years of technical > types demanding basic functionality of it. And the Macintosh has > had fifteen years of interface fascist users shaping its progress. > Windows has the hairpin turns of the Microsoft marketing machine > and that's all. -- Red Drag Diva > ----------------------------------------------------------------------- > 21 days until Talk Like a Pirate day
