bagle SpamAssassin rule [SCANNED]

[Dustin Baer]

David Vosburgh wrote:
>
> Dave's List Addy wrote:
>
> >On 3/3/04 9:31 AM, "Dustin Baer" wrote:
> >
> >
> >
> >>For those of you who want to try to catch these with SpamAssassin, I
> >>think the following should work:
> >>
> >>body     BAGLE_PASSWORD /password.*[0-9]{4,}/i
> >>describe BAGLE_PASSWORD Password.*numbers
> >>score    BAGLE_PASSWORD 6.5
> >>
> >>If anyone has a better suggestion, let us know!
> >>
> >>
> >
> >Has anyone found this to work? We can't upgrade as of yet to the latest MS
> >since we did a apt-get install :( Will know better next time :)
> >
> I tried it briefly but was getting more false positives than legitimate
> hits.  The problem seemed to be primarily caused by phone numbers
> (specifically, the last four digits) included in the senders signature
> coming after "password".  That ".*" is pretty aggressive ;-).

Yeah, it SUCKS!

I removed it this morning.

Dustin

--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836