local rule doesn't hit

[Joe Vieira <jv...@clarku.edu>]

Hi,

    I am pretty new at writing local rules, and since we've been getting 
a lot of targeted phishing emails i've been writing some rules to stop 
them ( running them thru the public corpus's after i write them )

    I have a rule body __LOCAL_IT_SPOOF_1 m'account 
(?:verification|expire|detail|expiration)'i

and the message which i am trying to match is (this is just a snip)

Dear Subscriber,
This mail is to inform all our {.EDU} users that we will be upgrading
our site in a couple of days from now, So you as a Subscriber of our
site, you are required to send us your Email *account detail*s so as to
enable us know if you are still making use of your mail box. Further
be informed that we will be deleting all mail account that is not
functioning so as to create more space for our new users. So you are
to send us your mail account details which are as follows:

so from my thinking that should match the bold section...spamassasin -D 
does't show the rule being hit at all...

any ideas?

SpamAssassin version 3.2.4
  running on Perl version 5.8.8

Thanks,
Joe Vieira

Re: local rule doesn't hit

[Joe Vieira <jv...@clarku.edu>]

I know they are indirect, in debug mode it shows __ rules that hit as 
well. other non-scored rules do hit.

Joe

Matus UHLAR - fantomas wrote:
> On 06.10.08 11:43, Joe Vieira wrote:
>   
>>    I have a rule body __LOCAL_IT_SPOOF_1 m'account
>> (?:verification|expire|detail|expiration)'i
>>     
>
> the __ rules are indirect and not scored. You can use them in meta rules.
>
> remove those __ at begin and see if they hit
>
> --
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> 2B|!2B, that's a question!
>   

Re: local rule doesn't hit

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

On 06.10.08 11:43, Joe Vieira wrote:
>    I have a rule body __LOCAL_IT_SPOOF_1 m'account 
> (?:verification|expire|detail|expiration)'i

the __ rules are indirect and not scored. You can use them in meta rules.

remove those __ at begin and see if they hit

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
2B|!2B, that's a question!