bagle SpamAssassin rule [SCANNED]

[David Vosburgh]

Dave's List Addy wrote:

>On 3/3/04 9:31 AM, "Dustin Baer" wrote:
>
>
>
>>For those of you who want to try to catch these with SpamAssassin, I
>>think the following should work:
>>
>>body     BAGLE_PASSWORD /password.*[0-9]{4,}/i
>>describe BAGLE_PASSWORD Password.*numbers
>>score    BAGLE_PASSWORD 6.5
>>
>>If anyone has a better suggestion, let us know!
>>
>>
>
>Has anyone found this to work? We can't upgrade as of yet to the latest MS
>since we did a apt-get install :( Will know better next time :)
>
I tried it briefly but was getting more false positives than legitimate
hits.  The problem seemed to be primarily caused by phone numbers
(specifically, the last four digits) included in the senders signature
coming after "password".  That ".*" is pretty aggressive ;-).

>--
>Thanks!!
>David Thurman
>List Only at Web Presence Group Net
>
>
>
--

Dave Vosburgh