Karsten Bräckelmann wrote: > On Tue, 2009-10-20 at 07:16 -0400, Martin G. Diehl wrote: >> I see a lot of SPAM with garbage Subject and/or >> garbage in the From and/or Reply-To name fields. >> >> Here are some recent examples that were NOT flagged >> as ***SPAM*** ... > >> From: "±è³ÝºÏ" <[email protected]> >> Reply-To: "±è³ÝºÏ" <[email protected]> >> Subject: ¹«·á¹Ì´Ï³ëÆ®ºÏÀÌ µµÂøÇß½À´Ï´Ù! > > header FOO Subject =~ /[[:word:][:punct:] ]{10}/ > > Note, entirely untested and written in a haste. Copy-n-pastes like this > are useless, we need the RAW, unaltered headers.
That reminds me of my adventures in KHOP_NO_FULL_NAME, currently scored 0.001 and located in my experimental khop-lists channel (live on my production servers), # This matches foreign characters by process of elimination. # From: must start w/ ~uppercase, ~letters, space/punctuation, then ~uppercase. header __FROM_FULL_NAME From:name =~ /^[^a-z[:punct:][:cntrl:]\d\s][^[:punct:][:cntrl:]\d\s]*[[:punct:]\s]+[^a-z[:punct:][:cntrl:]\d\s]/ meta KHOP_NO_FULL_NAME !(__PREC_BULK || __FROM_ENCODED_QP || __FROM_NEEDS_MIME || __FROM_FULL_NAME) describe KHOP_NO_FULL_NAME Sender does not have both First and Last names score KHOP_NO_FULL_NAME 0.001 # hits the same on ham v spam The original incarnation was far simpler and looked more like Karsten's code, but foreign characters are too common in ham. Even the current incarnation has trouble when it comes to social mail, where people use nicknames.
