[Wine] russian spam with only two lines in the body

[Martin Gregorie]

On Wed, 2010-08-25 at 11:43 +1200, Peter Lowish wrote:
> So this should do it in my .cf file
> 
> body     Ban_RussUrl    /www\..{1,16}\.ru/
> score    Ban_RussUrl 	15
> describe Ban_RussUrl 	Russian url spam
> 
Not quite. I suggested using a uri rule not a body one. A score of 5 or
6 should be enough. Be sure to test it: its rather a sledgehammer and
will certainly FP if your organisation has Russian correspondents.
Personally I'd use a meta because its far less likely to FP:

describe RU_SPAM Russian spam-bot messages
uri      __RU_S1 /www\..{1,16}\.ru/
header   __RU_S2 From =~ /[a-z]{7,8}[0-9]{4}\@/ 
header   __RU_S3 Reply-To =~ /[a-z]{7,8}[0-9]{4}\@/ 
meta     RU_SPAM (__RU_S1 &&__RU_S2 &&__RU_S3)
score    RU_SPAM 5.5

Caveat: this hasn't been lint checked or tested. Do both before
deploying it.


Martin