Current NEWESTA mail

[Mynabbler <my...@live.com>]

Does someone feel like giving the next incarnation of the Russian bride crap
a decent score? Send by Yahoo, of course,  and my previous generation filter
is useless against it. By the way, the previous filter was:

body NEWESTA /You will see some of my private
(?:photos|photographs|pictures|pics)|(?:respond|answer) back with my private
(?:photos|photographs|pictures|pics)|
(?:view|see|check out) my (?:most|best|own) (?:private|personal)
(?:photographs|photos|pictures|pics|images)\b

NEWESTA is the Russian word for 'bride', somewhat phonetically spelled,
hence the name. We are chickenpoxed in the current incarnation, but the
chickenpox filter is giving way too many false positives. This is what is
currently slipping through the filters:


From: "CASIE" <ri...@yahoo.com>

Mai.l me.. ..at spammer@hotmail.com and i @am goin^g t&o a#nswer back
with my pri^vate pic^tures.


-- 
View this message in context: http://old.nabble.com/Current-NEWESTA-mail-tp31324260p31324260.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Current NEWESTA mail

[John Hardin <jh...@impsec.org>]

On Tue, 5 Apr 2011, Mynabbler wrote:

> We are chickenpoxed in the current incarnation, but the
> chickenpox filter is giving way too many false positives.

Maybe the chickenpox rules need to be reincarnated as __subrules so they 
can be meta'd with things like FREEMAIL_FROM...

Are Jennifer Wheeler or Adam Lopresto on-list?

> Mai.l me.. ..at spammer@hotmail.com and i @am goin^g t&o a#nswer back
> with my pri^vate pic^tures.

Suggestion: in your local .cf, set the raw chickenpox scores to 0.050 and 
then add metas for chickenpox+FREEMAIL_FROM with higher scores and see how 
well that does.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   We are hell-bent and determined to allocate the talent, the
   resources, the money, the innovation to absolutely become a
   powerhouse in the ad business.       -- Microsoft CEO Steve Ballmer
   ...because allocating talent to securing Windows isn't profitable?
-----------------------------------------------------------------------
  8 days until Thomas Jefferson's 268th Birthday