Displaying 1 result from an estimated 1 matches for "__ru_s2".
Did you mean:
__ru_s1
2010 Aug 25
1
russian spam with only two lines in the body
...of 5 or
6 should be enough. Be sure to test it: its rather a sledgehammer and
will certainly FP if your organisation has Russian correspondents.
Personally I'd use a meta because its far less likely to FP:
describe RU_SPAM Russian spam-bot messages
uri __RU_S1 /www\..{1,16}\.ru/
header __RU_S2 From =~ /[a-z]{7,8}[0-9]{4}\@/
header __RU_S3 Reply-To =~ /[a-z]{7,8}[0-9]{4}\@/
meta RU_SPAM (__RU_S1 &&__RU_S2 &&__RU_S3)
score RU_SPAM 5.5
Caveat: this hasn't been lint checked or tested. Do both before
deploying it.
Martin