Re: "Pill" spams

On Fri, 20 Apr 2012, Ned Slider wrote:

> On 16/04/12 04:56, John Hardin wrote:
>>
>>  header SUBJ_ODD_CASE ALL =~
>>  /\n(?!(?:Subject:|SUBJECT:|subject:))(?i:subject:)/sm
>>  describe SUBJ_ODD_CASE Oddly mixed-case Subject: header
>
> I have quite a few examples of these in my archives, and I confirm your rule
> catches them - nice job :-)

Yay. Hopefully those will start showing up in the corpus so that rule will
get promoted out of my sandbox.

> Further, I note that to date the examples I have also appear to be omitting a
> space between the end of "Subject:" and the start of the actual subject text
> (examples on pastebin below). I wonder if this could also be leveraged into a
> rule?

Already there.

http://ruleqa.spamassassin.org/20120420-r1328260-n/T_HDRS_MISSP

It's not doing too well at the moment given corpus starvation. I don't
think it's in the last update either.

Again, having those messages in the spam corpus would help...

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   Where We Want You To Go Today 09/13/07: Microsoft patents in-OS
   adware architecture that incorporates monitoring and analysis of
   user actions and interrupting the user to display apparently
   relevant advertisements (U.S. Patent #20070214042)
-----------------------------------------------------------------------
  3 days until Max Planck's 154th birthday