----- Original Message -----
From: "Loren Wilton" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Friday, February 06, 2004 7:39 PM
Subject: How can I catch this one
> The following seems like a real common way to end a spam, yet no rule
> catches it. I've been trying to write such a rule, but I just don't know
> enough about regexps to get it to work rather than blow up in my face. I
> assume you have to use rawbody to catch this, which is still
line-oriented,
> and the pattern has to span multiple lines to work.
>
> Sample junk:
>
> </BODY></HTML>
> <br>
> baboon poppy burnett lengthwise hoar deadline diophantine infra pius malay
> dire silica diffract alcestis beachcomb hammerhead scintillate pussy giant
> genii deformation bodice anvil chromic scatterbrain contingent diploid
> humphrey considerate globule beauteous drunkard bellini buoy palmyra
> revolutionary cranelike cried amelia govern <br>
> freeman fifty fragment gingham marks comptroller alfonso madmen rumford
> erbium cochran continuity bainite antiquarian maurine demonstrable bambi
> serf fickle denote arteriole janeiro cease drunk ifni chartroom antony
coma
> molten dupont allegory greengrocer airstrip drip crewel beriberi agone
> calico instantiate <br>
With some hints from other here on the list, here is what I've been using
successfully to catch these kinds of messages, as well a long strings of
garbage text:
body RANDOMWORDS_7
/(?:\b(?!(?:from|even|more|were|with)\b)[a-zA-Z]{4,12}\s+){7}/
describe RANDOMWORDS_7 string of 7+ random words
score RANDOMWORDS_7 1.0
body RANDOMWORDS_10
/(?:\b(?!(?:from|even|more|were|with)\b)[a-zA-Z]{4,12}\s+){10}/
describe RANDOMWORDS_10 string of 10+ random words
score RANDOMWORDS_10 2.0
body RANDOMWORDS_15
/(?:\b(?!(?:from|even|more|were|with)\b)[a-zA-Z]{4,12}\s+){15}/
describe RANDOMWORDS_15 string of 15+ random words
score RANDOMWORDS_15 3.0
body RANDOMWORDS_20
/(?:\b(?!(?:from|even|more|were|with)\b)[a-zA-Z]{4,12}\s+){20}/
describe RANDOMWORDS_20 string of 20+ random words
score RANDOMWORDS_20 4.0
body RANDOMWORDS_25
/(?:\b(?!(?:from|even|more|were|with)\b)[a-zA-Z]{4,12}\s+){25}/
describe RANDOMWORDS_25 string of 25+ random words
score RANDOMWORDS_25 5.0
body LONGWORDS_15 /[a-zA-Z]{15}/
describe LONGWORDS_15 string of 15+ random letters
score LONGWORDS_15 5.0
body LONGWORDS_20 /[a-zA-Z]{20}/
describe LONGWORDS_20 string of 20+ random letters
score LONGWORDS_20 5.0
body LONGWORDS_25 /[a-zA-Z]{25}/
describe LONGWORDS_25 string of 25+ random letters
score LONGWORDS_25 5.0
body LONGWORDS_30 /[a-zA-Z]{30}/
describe LONGWORDS_30 string of 30+ random letters
score LONGWORDS_30 5.0
body LONGWORDS_35 /[a-zA-Z]{35}/
describe LONGWORDS_35 string of 35+ random letters
score LONGWORDS_35 5.0
body LONGWORDS_40 /[a-zA-Z]{40}/
describe LONGWORDS_40 string of 40+ random letters
score LONGWORDS_40 5.0
body LONGWORDS_45 /[a-zA-Z]{45}/
describe LONGWORDS_45 string of 45+ random letters
score LONGWORDS_45 5.0
body LONGWORDS_50 /[a-zA-Z]{50}/
describe LONGWORDS_50 string of 50+ random letters
score LONGWORDS_50 5.0
Bill
