> -----Original Message----- > From: ItsMikeE [mailto:[EMAIL PROTECTED] > Sent: Monday, 18 February 2008 11:33 p.m. > To: users@spamassassin.apache.org > Subject: "Nice girl like to chat" spam > > > For some time now I have been getting spams that look like > "Hello! I am tired this evening. I am nice girl that would like to chat > with > you. Email me at [EMAIL PROTECTED] only, because I am using my friend's > email > to write this. To see my pics" > > They are still not being picked up, despite me passing them to be learnt > for > the bayes DB. > > Has anyone written a rule to filter these out? > -- > View this message in context: http://www.nabble.com/%22Nice-girl-like-to- > chat%22-spam-tp15542352p15542352.html > Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Yes, I've got rules against that spam! They were sending us a ton of it so I wrote some local.cf rules: body __NICEGIRL_SPAM_1 /Hello! I am (tired|bored) this afternoon/ body __NICEGIRL_SPAM_2 /I am nice girl that would like to chat with you/ body __NICEGIRL_SPAM_3 /[EMAIL PROTECTED]/ meta CST_NICEGRL_SPAM (((1.0* __NICEGIRL_SPAM_1) + (1.0* __NICEGIRL_SPAM_2) + (2 * __NICEGIRL_SPAM_3)) > 1) score CST_NICEGRL_SPAM 7.0 describe CST_NICEGRL_SPAM Want-to-chat SPAM With this, the first two rules have to match for it to trigger, or the 3rd rule by itself can trigger it too (email link to TheHealCare.info). Works rather well, haven't seen any of that spam lately. Matching phrases works really well in SA but you have to watch out for the spammers that are onto changing the way words are spelt, and intentionally mis-spelling words to bypass rules, hence the (tired|bored) part may need to become (tireed|tired|bored) etc. Cheers, Mike
