Please do not hi-jack threads. Compose a new email rather than hitting
Reply. Changing the subject does not make it a new thread.

Well, at least it's related.

On Sat, 2008-11-01 at 17:00 +0000, Martin Gregorie wrote:
> I've started to see Casino spam in the last week and noticed, that of
> the five examples I captured, only one was hit by the FM_VEGAS_CASINO
> rule, which appears to be too narrowly targeted on Las Vegas casinos

These are actually malware spreading mail. ClamAV plus its third-party
SaneSecurity phish sigs do stop almost all of those quite nicely.

Also, various URI BLs should include the URIs rather early. Are you
perhaps missing some of these in your SA setup? Maybe put some examples
up a pastebin and send the link here.

> I've written a rule running that hits all five example messages and none
> of the other 59 messages on my rogues gallery. If this is of interest to
> the rest of the SA community, kindly let me know how new rule
> suggestions should be submitted.

If you're feeling confident about the rule, you can open a new bug.
However, you always can simply post it here for discussion and a broader
peer-review first in either case.


char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a \x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}