spamassassin-users October 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: rule to catch subject spamming

Re: rule to catch subject spamming

From: RW <rwmaillists_at_nospam>
Date: Sat Oct 23 2010 - 20:17:30 GMT
To: users@spamassassin.apache.org

On Sat, 23 Oct 2010 14:28:38 -0230
"Lawrence @ Rogers" <lawrencewilliams@nl.rogers.com> wrote:

> Hello all,
>
> I noticed recently that our users are getting spam with the subject
> similar to the following:
>
> SehxpyNaturalRedheaddFayeReaganHasHerFirstLesbianExperienceWithBrunet
>

I got some of these a while ago. They were pretty hard to catch because
they came through Hotmail and had little to work with in the body.
I added:

header SUBJ_LONG_WORD Subject =~ /\b[^[:space:][:punct:]]{30}/
describe SUBJ_LONG_WORD Longwordinsubjectlikethis
score SUBJ_LONG_WORD 2.0

header SUBJ_JOIN_CAP_WORD Subject =~ /([[:upper:]]+[[:lower:]]+){5}/
describe SUBJ_JOIN_CAP_WORD JoinedCapitalizedWordsRuntogether
score SUBJ_JOIN_CAP_WORD 1.5

They are missing some "?:", but for single header rules I don't really
care.