Re: "Pill" spams

by Ned Slider :: Rate this Message:

On 16/04/12 04:56, John Hardin wrote:

> On Tue, 10 Apr 2012, John Hardin wrote:
>
>> On Tue, 10 Apr 2012, Thomas Johnson wrote:
>>
>>> On Tue, Apr 10, 2012 at 7:08 AM, Bowie Bailey <Bowie_Bailey@...>
>>> wrote:
>>> > That sounds like it might be good rule-fodder. "subject", "Subject",
>>> > and "SUBJECT" are possibly valid, but the other funky capitalizations
>>> > might be worth a few points.
>>>
>>> And how would one write a rule for that?
>>
>> Check the __TO_EQ_FM header rules for ideas.
>>
>> I'll take a shot at something this weekend if nobody does earlier.
>
> I supplied this directly to Thomas earlier in the week, and it's in my
> sandbox:
>
> header SUBJ_ODD_CASE ALL =~
> /\n(?!(?:Subject:|SUBJECT:|subject:))(?i:subject:)/sm
> describe SUBJ_ODD_CASE Oddly mixed-case Subject: header
>
>

Hi John,

I have quite a few examples of these in my archives, and I confirm your
rule catches them - nice job :-)

Further, I note that to date the examples I have also appear to be
omitting a space between the end of "Subject:" and the start of the
actual subject text (examples on pastebin below). I wonder if this could
also be leveraged into a rule?

http://pastebin.com/xPf4XgJY

For example, I'd expect to see:

Subject: Re: Some text

and not:

Subject:Re:Some text

I have ~100 further examples of these that do not have mixed case
Subject (pastebin below), mostly pill spams that look like they are sent
by the same broken bot mailer, just with "Subject" in more conventional
case.

http://pastebin.com/Zu0uvViQ

Regards.

« Return to Thread: "Pill" spams