Unfortunately she changes the .info domain as often as she changes her knickers. :-p
Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -----Original Message----- > From: Michael Hutchinson [mailto:[EMAIL PROTECTED] > Sent: 18 February 2008 20:10 > To: users@spamassassin.apache.org > Subject: FW: "Nice girl like to chat" spam > > > -----Original Message----- > > From: ItsMikeE [mailto:[EMAIL PROTECTED] > > Sent: Monday, 18 February 2008 11:33 p.m. > > To: users@spamassassin.apache.org > > Subject: "Nice girl like to chat" spam > > > > > > For some time now I have been getting spams that look like > > "Hello! I am tired this evening. I am nice girl that would like to > chat > > with > > you. Email me at [EMAIL PROTECTED] only, because I am using > my friend's > > email > > to write this. To see my pics" > > > > They are still not being picked up, despite me passing them to be > learnt > > for > > the bayes DB. > > > > Has anyone written a rule to filter these out? > > -- > > View this message in context: > http://www.nabble.com/%22Nice-girl-like-to- > > chat%22-spam-tp15542352p15542352.html > > Sent from the SpamAssassin - Users mailing list archive at > Nabble.com. > > > Yes, I've got rules against that spam! They were sending us a > ton of it > so I wrote some local.cf rules: > > body __NICEGIRL_SPAM_1 /Hello! I am (tired|bored) this > afternoon/ > body __NICEGIRL_SPAM_2 /I am nice girl that would > like to chat > with you/ > body __NICEGIRL_SPAM_3 /[EMAIL PROTECTED]/ > meta CST_NICEGRL_SPAM (((1.0* __NICEGIRL_SPAM_1) + (1.0* > __NICEGIRL_SPAM_2) + (2 * __NICEGIRL_SPAM_3)) > 1) > score CST_NICEGRL_SPAM 7.0 > describe CST_NICEGRL_SPAM Want-to-chat SPAM > > With this, the first two rules have to match for it to trigger, or the > 3rd rule by itself can trigger it too (email link to > TheHealCare.info). > > Works rather well, haven't seen any of that spam lately. Matching > phrases works really well in SA but you have to watch out for the > spammers that are onto changing the way words are spelt, and > intentionally mis-spelling words to bypass rules, hence the > (tired|bored) part may need to become (tireed|tired|bored) etc. > > > Cheers, > Mike >