You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by patrickbaer <p....@tvwerk.de> on 2008/09/15 10:21:42 UTC
Searching for a line-pattern
Sorry for not posting a whole email, I tried but the message got blocked :)
My problem are those two-liners: One line of text, second line a link only.
Just like:
New versions of pills for you
www.gmx.net
So the pattern should be /two lines only, second one link/
Sorry for not saying anything more, but I have no idea how to describe this
or what to do .(
--
View this message in context: http://www.nabble.com/Searching-for-a-line-pattern-tp19488817p19488817.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Searching for a line-pattern
Posted by patrickbaer <p....@tvwerk.de>.
It's ugly, but it actually seems to work:
rawbody PBA_TEST /Content.*\n\n.*\n.*http.*\n\n-----/
Any comments before I activate it?
patrickbaer wrote:
>
> Sorry for not posting a whole email, I tried but the message got blocked
> :)
>
> My problem are those two-liners: One line of text, second line a link
> only. Just like:
>
> New versions of pills for you
> www.gmx.net
>
> So the pattern should be /two lines only, second one link/
>
> Sorry for not saying anything more, but I have no idea how to describe
> this or what to do .(
>
--
View this message in context: http://www.nabble.com/Searching-for-a-line-pattern-tp19488817p19527787.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Searching for a line-pattern
Posted by PileOfMush <pi...@hotmail.com>.
If pastebin doesn't work for you because of it's spam filter (lots of humor
to be found in there somewhere) try another one like slexy.org. Not as good,
but it seems to lack any sort of spam filter.
As for your problem, maybe you can see if Day Old Bread is picking up on the
URL spam you're seeing... and if so, maybe add some weight to the score. I'm
working on the same exact thing right now.
patrickbaer wrote:
>
> Thank you Martin, but that does not solve it.
>
> The text is always different, as well as the links. But who else sends
> emails with just two lines? So if that pattern matches with a score of 2
> or 3 and it hits some other rules as well, I am fine :)
>
>
>
> Martin Gregorie-2 wrote:
>>
>> On Mon, 2008-09-15 at 01:21 -0700, patrickbaer wrote:
>>> Sorry for not posting a whole email, I tried but the message got blocked
>>> :)
>>>
>>> My problem are those two-liners: One line of text, second line a link
>>> only.
>>> Just like:
>>>
>>> New versions of pills for you
>>> www.gmx.net
>>>
>>> So the pattern should be /two lines only, second one link/
>>>
>> Sounds like you need to use a meta-rule to me, with the first pattern
>> being case insensitive and containing one or more phrases, the second
>> matching the URI(s) and the meta rule combining the results:
>>
>> body MR1 /(phrase in line 1|alternate phrase|)/i
>> uri MR2 /objectional.url/
>> meta METARULE (MR1 && MR2)
>> score METARULE 2.0
>>
>> Each of the subrules will score 1.0 as written and will be listed if
>> they fire (good for developing & testing the rule). If you don't want
>> that, change MR1 and MR2 to __MR1 and __MR2 when they're working and (a)
>> the subrules are no longer listed and (b) the score will be 2.0 if buth
>> subrules match and zero otherwise.
>>
>>
>> Martin
>>
>>
>>
>>
>
>
--
View this message in context: http://www.nabble.com/Searching-for-a-line-pattern-tp19488817p19500402.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Searching for a line-pattern
Posted by patrickbaer <p....@tvwerk.de>.
Thank you Martin, but that does not solve it.
The text is always different, as well as the links. But who else sends
emails with just two lines? So if that pattern matches with a score of 2 or
3 and it hits some other rules as well, I am fine :)
Martin Gregorie-2 wrote:
>
> On Mon, 2008-09-15 at 01:21 -0700, patrickbaer wrote:
>> Sorry for not posting a whole email, I tried but the message got blocked
>> :)
>>
>> My problem are those two-liners: One line of text, second line a link
>> only.
>> Just like:
>>
>> New versions of pills for you
>> www.gmx.net
>>
>> So the pattern should be /two lines only, second one link/
>>
> Sounds like you need to use a meta-rule to me, with the first pattern
> being case insensitive and containing one or more phrases, the second
> matching the URI(s) and the meta rule combining the results:
>
> body MR1 /(phrase in line 1|alternate phrase|)/i
> uri MR2 /objectional.url/
> meta METARULE (MR1 && MR2)
> score METARULE 2.0
>
> Each of the subrules will score 1.0 as written and will be listed if
> they fire (good for developing & testing the rule). If you don't want
> that, change MR1 and MR2 to __MR1 and __MR2 when they're working and (a)
> the subrules are no longer listed and (b) the score will be 2.0 if buth
> subrules match and zero otherwise.
>
>
> Martin
>
>
>
>
--
View this message in context: http://www.nabble.com/Searching-for-a-line-pattern-tp19488817p19490704.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Searching for a line-pattern
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2008-09-15 at 01:21 -0700, patrickbaer wrote:
> Sorry for not posting a whole email, I tried but the message got blocked :)
>
> My problem are those two-liners: One line of text, second line a link only.
> Just like:
>
> New versions of pills for you
> www.gmx.net
>
> So the pattern should be /two lines only, second one link/
>
Sounds like you need to use a meta-rule to me, with the first pattern
being case insensitive and containing one or more phrases, the second
matching the URI(s) and the meta rule combining the results:
body MR1 /(phrase in line 1|alternate phrase|)/i
uri MR2 /objectional.url/
meta METARULE (MR1 && MR2)
score METARULE 2.0
Each of the subrules will score 1.0 as written and will be listed if
they fire (good for developing & testing the rule). If you don't want
that, change MR1 and MR2 to __MR1 and __MR2 when they're working and (a)
the subrules are no longer listed and (b) the score will be 2.0 if buth
subrules match and zero otherwise.
Martin