I had the a problem with your below listed stock spam and others, most of them also have a 'price' and a 'symbl' in the body. found the following rule works well enough...even though it's pretty ugly
header __XMStockSGen Subject =~
/(?:[i|!1l]\W*(?:n|\|\\\|)\W*(?:v|\\\/)\W*[e3]\W*[5s\$]\W*[t7]|[e3]\W*q\W*[uy]\W*[i|!1l]\W*[t7]\W*y|[5s\$]\W*[t7]\W*(?:o|0|\(\))\W*[c<(]\W*(?:k|\|\<)|[EMAIL
PROTECTED](?:[e3]|[i|!1l]\W*(?:n|\|\\\|)\W*g)|[c<(]\W*(?:o|0|\(\))\W*(?:m|\|\\\/\|)[EMAIL
PROTECTED](?:n|\|\\\|)(?:y|[i|!1l]\W*[e3]\W*[5s\$])|p\W*r\W*(?:o|0|\(\))\W*f\W*[i|!1l]\W*[t7]|p\W*(?:o|0|\(\))\W*r\W*[t7]\W*f\W*(?:o|0|\(\))\W*[i|!1l]\W*[i|!1l]\W*(?:o|0|\(\))|(?:[5s\$]\W*(?:m|\|\\\/\|)[EMAIL
PROTECTED]|!1l]\W*[i|!1l]|(?:m|\|\\\/\|)\W*[i|!1l]\W*[c<(]\W*r\W*(?:o|0|\(\)))\W*[c<([EMAIL
PROTECTED]|(?:o|0|\(\))\W*(?:v|\\\/)\W*[e3]\W*r\W*[i|!1l]\W*(?:o|0|\(\))\W*(?:o|0|\(\))\W*(?:k|\|\<)|(?:w|\\\/\\\/)[EMAIL
PROTECTED]|!1l]\W*[i|!1l]\W*[5s\$]\W*[t7]\W*r\W*[e3]\W*[e3]\W*[t7]|(?:m|\|\\\/\|)[EMAIL
PROTECTED](?:k|\|\<)\W*[e3]\W*[t7]|(?:h|\|-\|)\W*(?:o|0|\(\))\W*[t7]\W*p\W*[i|!1l]\W*[c<(]\W*(?:k|\|\<)\W*[5s\$])/i
rawbody __XMStockSymb
/^[5s\$]\W*y\W*(?:m|\|\\\/\|)\W*b\W*(?:o|0|\(\))\W*[i|!1l]\W*\w{2,5}\s*$/i
rawbody __XMStockPrce
/^p\W*r\W*[i|!1l]\W*[c<(]\W*[e3]\W*\d+(?:\.\w+)?\s*$/
meta XMStockSpam_05 (__XMStockSGen &&
__XMStockPrce && __XMStockSymb)
On Sat, Apr 02, 2005 at 05:24:51PM -0500, kalin mintchev wrote:
>
> hi all....
>
> increasingly over the last month the filter has letting spam through. some
> days is ok - some like last night really bad - i got 60 spam messages. i
> have spamd running - nothing has changed. it does get some of the spam
> still but crap like this is getting through. and on top of it it
> autolearns it as ham?! how do i add this to my bayes db if i'm on a
> vpopmail machine where every user has it's own user_prefs?
>
> crap:
>
> Return-Path: <[EMAIL PROTECTED]>
> Delivered-To: [EMAIL PROTECTED]
> Received: (qmail 61346 invoked by uid 1008); 2 Apr 2005 21:47:46 -0000
> Delivered-To: [EMAIL PROTECTED]
> Received: (qmail 61171 invoked by uid 1008); 2 Apr 2005 21:47:40 -0000
> Received: from unknown (HELO dnt-gw2-zagros.dnttm.ro) (193.226.88.153)
> by mail.el.net with SMTP; 2 Apr 2005 21:47:40 -0000
> Received: from ornately
> (ILZS-207-772.future-online.net [69.6.2.73] (may be forged))
> by silken.future-online.net (MOS 3.3.9-GR) with ESMTP id DEH05665
> (AUTH ornately-05)
> ; Sat, 02 Apr 2005 16:43:08 -0500 (IST)
> Date: Sat, 02 Apr 2005 20:39:08 -0100
> From: "Rena Hodge" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Subject: This st0ck has everything going for it
> Message-ID: <[EMAIL PROTECTED]>
> MIME-Version: 1.0
> Content-Type: text/plain; charset="UTF-8"
> Content-Transfer-Encoding: 7Bit
> X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on chavo.el.net
> X-Spam-Level:
> X-Spam-Status: No, score=-2.6 required=3.0 tests=BAYES_00 autolearn=ham
> version=3.0.2
>
> --
>
>
>
>
>
>
--
______________________________________________________________________
what's with today, today?
Email: [EMAIL PROTECTED]
PGP: http://rocky.mindphone.org/rocky_mindphone.org.gpg
signature.asc
Description: Digital signature
