On Thu, 2012-10-04 at 20:56 -0700, Cathryn Mataga wrote: > I'm getting a lot of SPAM with words written like this. These are pretty > horrible, and I don't like > getting them every day. > > A:N ;A %L" > P:O ~R %N ( P &lCT U #R&E / > > Is there a way to make a rule for strings of characters that would > ignoring non-alpha characters embedded > in the string? > Try this:
describe MG_TWOLETTER_OBFUSCATION Two letter obfuscation (X:X X :X)) body MG_TWOLETTER_OBFUSCATION /[A-Z]\W[A-Z] \W[A-Z]\W[A-Z]/ score MG_TWOLETTER_OBFUSCATION 5.0 It matches the data you posted and does not match anything else in my spam corpus, so its quite specific the that type of spam, on the contents of my mail stream anyway, but of course ymmv. Martin
