On Wed, Aug 6, 2014 at 1:32 PM, Paul Stead <[email protected]>
wrote:
> 06/08/14 16:28, Quanah Gibson-Mount wrote:
>
> Would you be willing to share your full finalized ruleset? This spam is
> really obnoxious.
>
> Sure...
>
> A little adjustment as I noticed the brackets around the first number
> match was wrong:
>
> header __LOC_DIGITS_FROM From:name =~ /\.\d{7,8}$/
> body __LOC_DIGITS_CONFUSER / (\d{7,8}) .{1,250} ([0-9a-f]{32})
> .{1,250}[\g1|\g2] .{1,250}[\g1|\g2]/
>
> Something like...
>
> meta LOC_DIGITS_SPAM ( __LOC_DIGITS_FROM && __LOC_DIGITS_CONFUSER)
> score LOC_DIGITS_SPAM 0.001
>
header __LOC_DIGITS_FROM From:name =~ /\.\d{7,8}$/
body __LOC_DIGITS_CONFUSER / (\d{7,8}) .{1,250} ([0-9a-f]{32})
.{1,250}[\g1|\g2] .{1,250}[\g1|\g2]/
meta LOC_DIGITS_SPAM ( __LOC_DIGITS_FROM && __LOC_DIGITS_CONFUSER)
score LOC_DIGITS_SPAM 0.001
This doesn't pass lint:
Aug 6 14:37:30.617 [11275] warn: Unrecognized escape \g in character class
passed through in regex; marked by <-- HERE in m/ (\d{7,8}) .{1,250}
([0-9a-f]{32}) .{1,250}[\g <-- HERE 1|\g2] .{1,250}[\g1|\g2]/ at
/etc/mail/spamassassin/70_general.cf, rule __LOC_DIGITS_CONFUSER, line 1.
Aug 6 14:37:30.617 [11275] warn: Unrecognized escape \g in character class
passed through in regex; marked by <-- HERE in m/ (\d{7,8}) .{1,250}
([0-9a-f]{32}) .{1,250}[\g1|\g <-- HERE 2] .{1,250}[\g1|\g2]/ at
/etc/mail/spamassassin/70_general.cf, rule __LOC_DIGITS_CONFUSER, line 1.
Aug 6 14:37:30.617 [11275] warn: Unrecognized escape \g in character class
passed through in regex; marked by <-- HERE in m/ (\d{7,8}) .{1,250}
([0-9a-f]{32}) .{1,250}[\g1|\g2] .{1,250}[\g <-- HERE 1|\g2]/ at
/etc/mail/spamassassin/70_general.cf, rule __LOC_DIGITS_CONFUSER, line 1.
Aug 6 14:37:30.617 [11275] warn: Unrecognized escape \g in character class
passed through in regex; marked by <-- HERE in m/ (\d{7,8}) .{1,250}
([0-9a-f]{32}) .{1,250}[\g1|\g2] .{1,250}[\g1|\g <-- HERE 2]/ at
/etc/mail/spamassassin/70_general.cf, rule __LOC_DIGITS_CONFUSER, line 1.
Thanks,
Alex
