Mailing List Archive: SpamAssassin: users

local rule doesn't hit

Index | Next | Previous | View Threaded

jvieira at clarku

Oct 6, 2008, 8:43 AM

Post #1 of 3 (174 views)
Permalink

local rule doesn't hit

Hi,

I am pretty new at writing local rules, and since we've been getting
a lot of targeted phishing emails i've been writing some rules to stop
them ( running them thru the public corpus's after i write them )

I have a rule body __LOCAL_IT_SPOOF_1 m'account
(?:verification|expire|detail|expiration)'i

and the message which i am trying to match is (this is just a snip)

Dear Subscriber,
This mail is to inform all our {.EDU} users that we will be upgrading
our site in a couple of days from now, So you as a Subscriber of our
site, you are required to send us your Email *account detail*s so as to
enable us know if you are still making use of your mail box. Further
be informed that we will be deleting all mail account that is not
functioning so as to create more space for our new users. So you are
to send us your mail account details which are as follows:

so from my thinking that should match the bold section...spamassasin -D
does't show the rule being hit at all...

any ideas?

SpamAssassin version 3.2.4
running on Perl version 5.8.8

Thanks,
Joe Vieira

uhlar at fantomas

Oct 6, 2008, 8:50 AM

Post #2 of 3 (160 views)
Permalink

Re: local rule doesn't hit [In reply to]

On 06.10.08 11:43, Joe Vieira wrote:
> I have a rule body __LOCAL_IT_SPOOF_1 m'account
> (?:verification|expire|detail|expiration)'i

the __ rules are indirect and not scored. You can use them in meta rules.

remove those __ at begin and see if they hit

--
Matus UHLAR - fantomas, uhlar[at]fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
2B|!2B, that's a question!

jvieira at clarku

Oct 6, 2008, 9:59 AM

Post #3 of 3 (159 views)
Permalink

Re: local rule doesn't hit [In reply to]

I know they are indirect, in debug mode it shows __ rules that hit as
well. other non-scored rules do hit.

Joe

Matus UHLAR - fantomas wrote:
> On 06.10.08 11:43, Joe Vieira wrote:
>
>> I have a rule body __LOCAL_IT_SPOOF_1 m'account
>> (?:verification|expire|detail|expiration)'i
>>
>
> the __ rules are indirect and not scored. You can use them in meta rules.
>
> remove those __ at begin and see if they hit
>
> --
> Matus UHLAR - fantomas, uhlar[at]fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> 2B|!2B, that's a question!
>

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com