Loads of recent low-scoring snowshoe spam

2019-09-25 Thread Amir Caspi
Hi all, In recent weeks, my server has been getting hit with tons of snowshoe spam. Much of it is not getting filtered because even when it hits Bayes, it doesn't hit basically any other rules, and therefore is scoring just below 5 points. (Much of it hits only BAYES_50 and is therefore scori

Re: regex rule

2019-09-25 Thread RW
On Tue, 24 Sep 2019 22:02:59 +0200 j.emerlik wrote: > example: > > X-Account-Key: account4 > X-Mozilla-Keys: > > > Return-Path: > > but you can notice that after X-Mozilla-Keys: there is 81 chars > 0x020 or 0032 (space) > > Rule like thet dosn't work: > header __RULE_1X-Moz

Re: regex rule

2019-09-25 Thread Paul Stead
A bit of anchoring wouldn't go amiss either: header __RULE_1 X-Mozilla-Keys:raw =~ /^[\s\d]{80,}$/ Paul On Wed, 25 Sep 2019 at 13:04, Paul Stead wrote: > You want: > > header __RULE_1 X-Mozilla-Keys:raw =~ /[\s\d]{80,}/ > > note the :raw addition > > Paul > > On T

Re: regex rule

2019-09-25 Thread Paul Stead
You want: header __RULE_1 X-Mozilla-Keys:raw =~ /[\s\d]{80,}/ note the :raw addition Paul On Tue, 24 Sep 2019 at 21:57, j.emerlik wrote: > Example link: > > https://pastebin.com/index/yYBSNw5x > > > > wt., 24 wrz 2019 o 19:57 John Hardin napisaƂ(a): > >> On Tue, 24 Sep 2019, j

Re: regex rule

2019-09-25 Thread Matus UHLAR - fantomas
On 24.09.19 19:30, j.emerlik wrote: I am trying to catch some header field with spaces but it doesn't work eg.: header __RULE_1 Return-Path =~ /[\s\d]{80,}/ Anyone could help or know why it's doesn't work ? It's quite probably that the Return-Path is not the part of e-mail and i