Rule with "crossed" check

[Ruggero Ferretti - BitDesign Snc <ru...@bitdesign.it>]

Hi all,
I am receiving a lot of spam where the email subject is the first-name 
on the sender; e.g.:
Subject = Alexandra
 From = Alexandra Diaz
I would like to create a rule to detect such a SPAM, but I don't know 
how to include the result of a check into another; is there a way to do it ?

I tryed something like:
#---
header __PERS_NAME_S Subject =~ /^(\w+)$/
header __PERS_NAME_F From =~ /^$1/
meta PERS_NAME (__PERS_NAME_S && __PERS_NAME_F)
score PERS_NAME 5.0
#---
But it doesn't work. Any suggestion ?

Many thanks in advance,
MaRu

Re: Rule with "crossed" check

[Chris <cp...@earthlink.net>]

On Tuesday 14 November 2006 4:45 am, Ruggero Ferretti - BitDesign Snc wrote:
> Hi all,
> I am receiving a lot of spam where the email subject is the first-name
> on the sender; e.g.:
> Subject = Alexandra
>  From = Alexandra Diaz
> I would like to create a rule to detect such a SPAM, but I don't know
> how to include the result of a check into another; is there a way to do
> it ?
>
> I tryed something like:
> #---
> header __PERS_NAME_S Subject =~ /^(\w+)$/
> header __PERS_NAME_F From =~ /^$1/
> meta PERS_NAME (__PERS_NAME_S && __PERS_NAME_F)
> score PERS_NAME 5.0
> #---
> But it doesn't work. Any suggestion ?
>
> Many thanks in advance,
> MaRu

Here on my box these are being tagged very nicely with these:

Content analysis details:   (33.0 points, 5.0 required)

 pts rule name              description
---- ---------------------- 
--------------------------------------------------
 2.8 RCVD_FORGED_WROTE      Forged 'Received' header found ('wrote:' spam)
 0.0 RELAY_CHECKER_NORDNS   No PTR record
 2.7 DATE_IN_FUTURE_24_48   Date: is 24 to 48 hours after Received: date
 1.7 SARE_CSBIG             BODY: Only Spicy food gives me an Explosive 
Gain.
 1.7 SARE_MLB_Stock6        BODY: ML obfuscated ticker symbols
 1.5 LOGINHASH2             BODY: Classified as spam at unknown company, 
Germany
 1.5 LOGINHASH1             BODY: Spam at LogIn&Solutions AG, Germany
 5.0 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 0.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
                            above 50%
                            [cf: 100]
 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                            [cf: 100]
 3.7 PYZOR_CHECK            Listed in Pyzor (http://pyzor.sf.net/)
 2.2 DCC_CHECK              Listed in DCC 
(http://rhyolite.com/anti-spam/dcc/)
 0.8 DIGEST_MULTIPLE        Message hits more than one network digest check
 6.0 RELAY_CHECKER          Any RelayChecker rule hit
 1.0 SAGREY                 Adds 1.0 to spam from first-time senders

-- 
Chris