Logo Spam catchers

[Loren Wilton <lw...@earthlink.net>]

After a GREAT deal of experimentation (and discovering that "body" doesn't
do at all what I expected it to) I have some nice snappy spam catchers for
this case.

These will probably work fairly well, but have had limited testing so far.

        Loren

# logo-spam catchers

body    __LOGOS    /(?:\b[ILl]o[gq]o[s]?\b.*){4}/
body    __BAD_LOGOS   /\bIo[gq]o(?:s)?\b/
body    __POOR_QUALITY  /gua[lI]ity/

meta    SNAPPY_LOGOS  (__LOGOS && (__BAD_LOGOS || __POOR_QUALITY))
describe SNAPPY_LOGOS  Get your free logos here!  Only $19.95 each!!
score   SNAPPY_LOGOS  5.0

uri     SNAPSHUT   /www\.snapshut\.info/
score   SNAPSHUT   2.0
describe SNAPSHUT   An open-and-shut case of Spam!

Re: Logo Spam catchers - Version 2

[Loren Wilton <lw...@earthlink.net>]

Bob sent me some more spams to test on, and I modified things a bit to
handle some of the other cases.  A couple of these rules at the bottom can
be eliminated by adding www.snapshut.info and www.contra.info to the bigevil
list.

These probably ought to be checked against a real corpus, since that
RECEIVED_WWW_LOCAL rule might catch some real mail.

        Loren

# logo-spam catchers

header RECEIVED_WWW_LOCAL Received =~ /\(from www\@localhost\)/
describe RECEIVED_WWW_LOCAL Received from www@localhost - yea, riiight!
score RECEIVED_WWW_LOCAL 1.0

header __TO_SALES_AT  To =~ /^sales\@/
body    __LOGOS    /(?:\b[ILl]o[gq]o[s]?\b.*){3}/
body    __BAD_LOGOS   /\bIo[gq]o(?:s)?\b/i
body    __POOR_QUALITY  /gua[lI]ity/

meta    SNAPPY_LOGOS  (__TO_SALES && RECEIVED_WWW_LOCAL && (__BAD_LOGOS ||
__POOR_QUALITY))
describe SNAPPY_LOGOS  Get your free logos here!  Only $49.95 each!!
score   SNAPPY_LOGOS  3.0

uri     SNAPSHUT   /www\.(?:snapshut|contra)\.info/
score   SNAPSHUT   2.0
describe SNAPSHUT   An open-and-shut case of Spam!

meta SNAPPY_SPAM   (__TO_SALES_AT && RECEIVED_WWW_LOCAL && SNAPSHUT)
describe SNAPPY_SPAM  Other spam from snapshut.com
score SNAPPY_SPAM   2.0