The regex would be: [a-zA-Z]\s[a-zA-Z]\s[a-zA-z]\s
So, (IIRC) the rule could be: body LOCAL_GAPPY_WORDS /[a-zA-Z]\s[a-zA-Z]\s[a-zA-z]\s/ score LOCAL_GAPPY_WORDS 2 Try it with a low score to start with. I use the LOCAL_ prefix for any rules I put into local.cf. But, I am sure that the Rules or Rules DeJure pack would include a rule about this. I use these from FreeBSD ports, so I would expect there would be a apt-get/yum equivalent for the Linux users out these. If anything, try and find the rule that covers this and then up its score in local.cf. Also, be careful about putting samples out of spam in your mails. Sometimes people might actually pick you up as the spam, and, potentially worse, train their Bayesian filters to exclude you, automatically. > -----Original Message----- > From: Monty Ree [mailto:[EMAIL PROTECTED] > Sent: Tuesday, 17 October 2006 5:30 PM > To: users@spamassassin.apache.org > Subject: How to detect this spam.. > > > Hello.. > > I have received lots of spam mails like below... > > S B N S.P K IS BLOWING UP ON HEAVY PR CAMPAIGNS! > WATCH S B N S.P K TRADE ON TUESDAY OCTOBER 17! > > So I would like to make a rule to detect spam which use blank > for each > characters(over 3 characters) like below.. > > S(blank) B(blank) N(blank) > > Anyone who can make this rule? > > > Thanks... > > _________________________________________________________________ > 고.. 감.. 도.. 사.. 랑.. 만.. 들.. 기.. MSN 러브 > http://www.msn.co.kr/love/ >
