John W Mickevich wrote:
> Hello,
>
> I am relatively new to SpamAssassin and I hope I am asking this
> question via the appropriate channel. If not, please let me know.
> I have been receiving spam email that is not getting caught by
> SpamAssassin and want to add a rule to catch it. These particular
> spam emails have the same URL which shows up in the body of the email
> many times - I have seen it repeated as many as 12 times. For
> example:
> <http://www.thelevelgroup.net/9Lc591820lkc972ov63Ij142YOjd16uwEU102KFMp>
> <http://www.thelevelgroup.net/9Lc591820lkc972ov63Ij142YOjd16uwEU102KFMp>
> <http://www.thelevelgroup.net/9Lc591820lkc972ov63Ij142YOjd16uwEU102KFMp>
> For this example, I know I can use a URI rule to check for
> thelevelgroup.net. But, what if the URL changes? I want to add a
> rule which will add points if any url shows up in the body of the
> email more than a certain number of times. I assume I need to set a
> variable then count the occurrences, but I do now know how to do
> this, or if it is even possible. I am currently using SpamAssassin
> v2.64. Thanks!
Step 1: Upgrade to a newer version of SA (3.1.5 is current)
Step 2: Install Razor2 and URIBL
This is the results of your email on my system:
Content analysis details: (8.9 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
3.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: thelevelgroup.net]
3.4 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: thelevelgroup.net]
--
Bowie
