Searching for a line-pattern - SpamAssassin

This is a discussion on Searching for a line-pattern - SpamAssassin ; Sorry for not posting a whole email, I tried but the message got blocked My problem are those two-liners: One line of text, second line a link only. Just like: New versions of pills for you www.gmx.net So the pattern ...

+ Reply to Thread
Results 1 to 5 of 5

Thread: Searching for a line-pattern

  1. Searching for a line-pattern


    Sorry for not posting a whole email, I tried but the message got blocked

    My problem are those two-liners: One line of text, second line a link only.
    Just like:

    New versions of pills for you
    www.gmx.net

    So the pattern should be /two lines only, second one link/

    Sorry for not saying anything more, but I have no idea how to describe this
    or what to do .(
    --
    View this message in context: http://www.nabble.com/Searching-for-...p19488817.html
    Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


  2. Re: Searching for a line-pattern

    On Mon, 2008-09-15 at 01:21 -0700, patrickbaer wrote:
    > Sorry for not posting a whole email, I tried but the message got blocked
    >
    > My problem are those two-liners: One line of text, second line a link only.
    > Just like:
    >
    > New versions of pills for you
    > www.gmx.net
    >
    > So the pattern should be /two lines only, second one link/
    >

    Sounds like you need to use a meta-rule to me, with the first pattern
    being case insensitive and containing one or more phrases, the second
    matching the URI(s) and the meta rule combining the results:

    body MR1 /(phrase in line 1|alternate phrase|)/i
    uri MR2 /objectional.url/
    meta METARULE (MR1 && MR2)
    score METARULE 2.0

    Each of the subrules will score 1.0 as written and will be listed if
    they fire (good for developing & testing the rule). If you don't want
    that, change MR1 and MR2 to __MR1 and __MR2 when they're working and (a)
    the subrules are no longer listed and (b) the score will be 2.0 if buth
    subrules match and zero otherwise.


    Martin


  3. Re: Searching for a line-pattern


    Thank you Martin, but that does not solve it.

    The text is always different, as well as the links. But who else sends
    emails with just two lines? So if that pattern matches with a score of 2 or
    3 and it hits some other rules as well, I am fine



    Martin Gregorie-2 wrote:
    >
    > On Mon, 2008-09-15 at 01:21 -0700, patrickbaer wrote:
    >> Sorry for not posting a whole email, I tried but the message got blocked
    >>
    >>
    >> My problem are those two-liners: One line of text, second line a link
    >> only.
    >> Just like:
    >>
    >> New versions of pills for you
    >> www.gmx.net
    >>
    >> So the pattern should be /two lines only, second one link/
    >>

    > Sounds like you need to use a meta-rule to me, with the first pattern
    > being case insensitive and containing one or more phrases, the second
    > matching the URI(s) and the meta rule combining the results:
    >
    > body MR1 /(phrase in line 1|alternate phrase|)/i
    > uri MR2 /objectional.url/
    > meta METARULE (MR1 && MR2)
    > score METARULE 2.0
    >
    > Each of the subrules will score 1.0 as written and will be listed if
    > they fire (good for developing & testing the rule). If you don't want
    > that, change MR1 and MR2 to __MR1 and __MR2 when they're working and (a)
    > the subrules are no longer listed and (b) the score will be 2.0 if buth
    > subrules match and zero otherwise.
    >
    >
    > Martin
    >
    >
    >
    >


    --
    View this message in context: http://www.nabble.com/Searching-for-...p19490704.html
    Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


  4. Re: Searching for a line-pattern


    If pastebin doesn't work for you because of it's spam filter (lots of humor
    to be found in there somewhere) try another one like slexy.org. Not as good,
    but it seems to lack any sort of spam filter.

    As for your problem, maybe you can see if Day Old Bread is picking up on the
    URL spam you're seeing... and if so, maybe add some weight to the score. I'm
    working on the same exact thing right now.



    patrickbaer wrote:
    >
    > Thank you Martin, but that does not solve it.
    >
    > The text is always different, as well as the links. But who else sends
    > emails with just two lines? So if that pattern matches with a score of 2
    > or 3 and it hits some other rules as well, I am fine
    >
    >
    >
    > Martin Gregorie-2 wrote:
    >>
    >> On Mon, 2008-09-15 at 01:21 -0700, patrickbaer wrote:
    >>> Sorry for not posting a whole email, I tried but the message got blocked
    >>>
    >>>
    >>> My problem are those two-liners: One line of text, second line a link
    >>> only.
    >>> Just like:
    >>>
    >>> New versions of pills for you
    >>> www.gmx.net
    >>>
    >>> So the pattern should be /two lines only, second one link/
    >>>

    >> Sounds like you need to use a meta-rule to me, with the first pattern
    >> being case insensitive and containing one or more phrases, the second
    >> matching the URI(s) and the meta rule combining the results:
    >>
    >> body MR1 /(phrase in line 1|alternate phrase|)/i
    >> uri MR2 /objectional.url/
    >> meta METARULE (MR1 && MR2)
    >> score METARULE 2.0
    >>
    >> Each of the subrules will score 1.0 as written and will be listed if
    >> they fire (good for developing & testing the rule). If you don't want
    >> that, change MR1 and MR2 to __MR1 and __MR2 when they're working and (a)
    >> the subrules are no longer listed and (b) the score will be 2.0 if buth
    >> subrules match and zero otherwise.
    >>
    >>
    >> Martin
    >>
    >>
    >>
    >>

    >
    >


    --
    View this message in context: http://www.nabble.com/Searching-for-...p19500402.html
    Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


  5. Re: Searching for a line-pattern


    It's ugly, but it actually seems to work:

    rawbody PBA_TEST /Content.*\n\n.*\n.*http.*\n\n-----/

    Any comments before I activate it?



    patrickbaer wrote:
    >
    > Sorry for not posting a whole email, I tried but the message got blocked
    >
    >
    > My problem are those two-liners: One line of text, second line a link
    > only. Just like:
    >
    > New versions of pills for you
    > www.gmx.net
    >
    > So the pattern should be /two lines only, second one link/
    >
    > Sorry for not saying anything more, but I have no idea how to describe
    > this or what to do .(
    >



    --
    View this message in context: http://www.nabble.com/Searching-for-...p19527787.html
    Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


+ Reply to Thread