Rules for this

[Anton Krall <ak...@intruder.com.mx>]

Guys.. is there a rule file or something that can grab mails like this:
 
"I am sorry that it took so long to review your application but you were
finally
app rov ed    with 3% fixed     ra t e.   To get   [Full    Lo a n     Appro
v al]  visit this page and enter final details. The bank office manager will
contact you about your   lo a n"
 
When they use spaces and such?
 
Thx!
 
Anton Krall

Re: Rules for this

[Robert Menschel <Ro...@Menschel.net>]

Hello Anton,

Thursday, June 3, 2004, 7:20:00 AM, you wrote:

AK> Guys.. is there a rule file or something that can grab mails like this:
 
>> "I am sorry that it took so long to review your application but you were
>> finally app rov ed    with 3% fixed     ra t e.   To get   [Full
>> Lo a n     Appro v al]  visit this page and enter final details. The
>> bank office manager will contact you about your   lo a n"
 
AK> When they use spaces and such?

I don't find any published, but it's easy to construct:

Copy this rule:
>  body  OBFU_APPROVED  /approved/i
into the CGI at http://sandgnat.com/cmos/cmos.jsp and check the the
Obfu-only option.

The resulting rule will match any obfuscated or gappy "approved".  You
can then do the same thing for "approval".

Or (Chris, am I correct that) you can also do
>  body  OBFU_APPROVED  /approv(?:al|ed)/i
to catch them both.

Bob Menschel

Re: Rules for this

[Loren Wilton <lw...@earthlink.net>]

Hie thee off to rulesemporium and grab the various rulesets.  Many of them
contain rules for gappy text, and there are specific obfu sets to catch
various obfuscated words.

        Loren

----- Original Message ----- 
From: "Anton Krall" <ak...@intruder.com.mx>
To: <sp...@incubator.apache.org>
Sent: Thursday, June 03, 2004 7:20 AM
Subject: Rules for this


> Guys.. is there a rule file or something that can grab mails like this:
>
> "I am sorry that it took so long to review your application but you were
> finally
> app rov ed    with 3% fixed     ra t e.   To get   [Full    Lo a n
Appro
> v al]  visit this page and enter final details. The bank office manager
will
> contact you about your   lo a n"
>
> When they use spaces and such?
>
> Thx!
>
> Anton Krall
>