From: "Bob Apthorpe" <[EMAIL PROTECTED]>
> Hi,
>
> On Tue, 17 Feb 2004 09:07:34 -0500 "Pierre Thomson"
<[EMAIL PROTECTED]> wrote:
>
> > There is at least one evil mailer that uses random lowercase words in
> > the X-mailer field. I have a rule to match these; it's part of an
> > upcoming "randoms" ruleset...
> >
> > A few from my recent quarantine:
> >
> > >X-Mailer: efodvcvak nriadibn
> > >X-Mailer: baboon divulge erato
> > >X-Mailer: contributor penates bobbie
>
> I've found low FPs looking for "/^X-Mailer: [a-z ]*/"
>
> Ham (4):
> 2 X-Mailer: nmh
> 1 X-Mailer: sendhtml
> 1 X-Mailer: nc
> Spam (23):
> 7 X-Mailer: mailer
> 4 X-Mailer:
> 2 X-Mailer: artemis
> 1 X-Mailer: wwnjknm pwdaymrl
> 1 X-Mailer: wsixm camelback
> 1 X-Mailer: upgrade cider
> 1 X-Mailer: qrplz trance
> 1 X-Mailer: postscript salsify
> 1 X-Mailer: folklore collegiate obeisant
> 1 X-Mailer: bodovsky
> 1 X-Mailer: boccio
> 1 X-Mailer: billionaire
> 1 X-Mailer: arkadiy
>
> Would the following work?:
>
> header T_LCASED_XMAILER X-Mailer =~ /^[a-z ]*$/
> describe T_LCASED_XMAILER X-Mailer contains only lowercase words
> score T_LCASED_XMAILER 0.5
Not very well with your own examples. "pine" would also likely fail
to be properly detected.
{^_^}
