You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Robert Menschel <Ro...@Menschel.net> on 2005/04/15 08:17:51 UTC

Re[2]: Need for a new rule?

Hello SRH-Lists,

Wednesday, April 13, 2005, 1:49:33 PM, you wrote:

SL> I get millions (mil|ions?) of spams from this guy (well, not millions,
SL> but I have recieved 15 in the last 2 hours).

SL> While generic tests for character/letter obfuscation are difficult, this
SL> guy is pretty predictable.

SL>  body  SRH_PENNY2  /(?:e\s*mai\||mi[|l]{2}ions|resu\|ts|wi[|l]{2})/

Pretty good results here:
body     SRH_PENNY2   /(?:e\s*mai\||mi\|lions|mil\|ions|resu\|ts|wil\|wi\|l)/i
score    SRH_PENNY2   1
#counts  SRH_PENNY2   649s/0h of 293625 corpus (119414s/174211h RM) 04/14/05

Your patterns match only a small fraction of the words I'm currently
testing, but it's a really good start for anyone who needs to begin
working on these spam before our next SARE rule set file is ready.

Bob Menschel