From: Roman Serbski [mailto:[EMAIL PROTECTED] > > Dear all, > > Could you please help me with one SA subject rule that sometimes works > and sometimes doesn't. > > SpamAssassin 3.0.2 with qmail-scanner 1.25st. > > Everything works like a charm but we receive a lot of spam messages > from yahoo.com group with [expoforum_kg] subject. I created a rule in > 20_head_tests.cf to score all messages containing [expoforum_kg] in a > subject. I know I shouldn't use global cf rules but I was just > testing. > > 20_head_tests.cf: > > header EXPO_SUCKERS Subject =~ /\b(?:[a-z]([-_. > =~\/:,[EMAIL PROTECTED]&+;\"\'<>\\])\1{0,2}){4,}/i > describe EXPO_SUCKERS Subject: contains [expoforum_kg] > > > This is an example of successful detection: > > subj='[expoforum_kg] A D V E R T I S E - TO - M I L L I O N S' > > This is an example of unsuccessful detection: > > subj='[expoforum_kg] Paid ontime 50% profit'
The problem is that your rule is matching the expanded text seen in the first subject rather than the '[expoforum_kg]' that you seem to expect. Try this rule instead: header EXPO_SUCKERS Subject =~ /\b\[expoforum_kg\]\b/i Bowie
