Mailing List Archive

Not only bigevil, but evilnumbers too! Two slugs at once!

Loren

----- Original Message -----
From: "Douglas Kirkland" <douglas@slugstone.net>
To: <spamassassin-users@incubator.apache.org>
Sent: Saturday, February 28, 2004 9:42 AM
Subject: Here is one for the BigEvil


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> The following URL has a spam that got through. I feel it should be added
to
> the bigevil rule list.
>
> I have replaced the some of the receiving domains with the word 'SNIP'
just to
> make sure they do not get into the bigevil.
>
> http://slugstone.net/spam/spam.020228.txt

BTW, the following tests would have caught that one.

pts rule name description
---- ---------------------- ------------------------------------------------
--
3.0 PT_WORDLIST_13 BODY: string of 13+ random words
10 PT_WORDLIST_30 BODY: string of 30+ random words
1.0 PT_WORDLIST_10 BODY: string of 10+ random words

body PT_WORDLIST_10
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a-z]{4,12}\s+){10}/
describe PT_WORDLIST_10 string of 10+ random words
score PT_WORDLIST_10 1.0

body PT_WORDLIST_13
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a-z]{4,12}\s+){13}/
describe PT_WORDLIST_13 string of 13+ random words
score PT_WORDLIST_13 3.0

body PT_WORDLIST_30
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a-z]{4,12}\s+){30}/
describe PT_WORDLIST_30 string of 30+ random words
score PT_WORDLIST_30 10.0