Mailing List Archive

Scoring for "look alike" characters in subject?
I'm noticing a fair amount of spam getting through using letters in the
subject line that are outside the standard set of ASCII characters in an
effort to bypass spam filters. For example, instead of a capital "R",
there will be a letter that closely approximates a capital "R" but when
you look closely at it, you'll see the bottom of the rounded part of the
"R" never connects to the line running along the left side of the
letter.

I don't want to use a rule that is too-restrictive (like maybe banning
all non-standard ascii characters) but I also want to increase the
likelihood of email using these tactics getting flagged as spam.

I'm new to spamasssassin so I'm not sure if a rule like this already
exists or how I might go about finding this rule or what I should weight
it. I'm wondering if others on the list have rules to address this same
issue and can share their rule. Thanks.
Re: Scoring for "look alike" characters in subject? [ In reply to ]
Hi Steve,

There are many rules that look at this. The FUZZY Logic rules might help
and in the KAM ruleset, you'll see replace_tag lines and how they are used
in various places to shutdown spammers used to obfuscate words by using
other character sets and symbols. You can find the KAM.cf ruleset on
mcgrail.com under downloads and there is an SA Channel for it as well.

regards,
KAM
--
Kevin A. McGrail
Member, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
https://www.linkedin.com/in/kmcgrail - 703.798.0171


On Mon, Mar 15, 2021 at 6:59 AM Steve Dondley <s@dondley.com> wrote:

> I'm noticing a fair amount of spam getting through using letters in the
> subject line that are outside the standard set of ASCII characters in an
> effort to bypass spam filters. For example, instead of a capital "R",
> there will be a letter that closely approximates a capital "R" but when
> you look closely at it, you'll see the bottom of the rounded part of the
> "R" never connects to the line running along the left side of the
> letter.
>
> I don't want to use a rule that is too-restrictive (like maybe banning
> all non-standard ascii characters) but I also want to increase the
> likelihood of email using these tactics getting flagged as spam.
>
> I'm new to spamasssassin so I'm not sure if a rule like this already
> exists or how I might go about finding this rule or what I should weight
> it. I'm wondering if others on the list have rules to address this same
> issue and can share their rule. Thanks.
>