Mailing List Archive: They are getting harder to filter out...

They are getting harder to filter out...

Mar 5, 2004, 2:42 AM

Post #1 of 3 (502 views)

This puppy just made it through. Other than feeding it to Bayes (which I
have just done) and some misspellings of common drugz, there doesn';t seem
to be a whole lot to go on here.

-----------------------------------------------
Subject: Biggest meedication site on net, Lwilton! Exceptional offers for
you!
Date: Fri, 05 Mar 2004 03:07:02 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0017_42A8EEC1.D2772C42"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2462.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Virus-Scanned: by amavisd-milter at
chcgil2-ar7-4-3-047-136.chcgil2.dsl-verizon.net
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11)
X-Spam-Level: ***
X-Spam-Status: No, hits=3.0 required=4.6 tests=BAYES_30,HTML_MESSAGE,
MANY_EXCLAMATIONS,NOT_TO_ME autolearn=no version=2.63
Status:

This is a multi-part message in MIME format.

------=_NextPart_000_0017_42A8EEC1.D2772C42
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

Well well!
Liberty is the right to choose, freedom is the result of that choice.
Lwilton, looking for a place to purchase medicatiQoxn?
Greatest ViagWyra and Cialydis
Quick weight (hemispheroidal plyers) loss and anti-depressant meedication!
Best cost on ValiuuGm and XanaNnx
Best deals, 80 pcenert off!
We ship wlordwide

Here you will find it:
http://individualizingly.selcydc.com/d13/index.php?id=d13
You are completely anonymous!
If you are going to do something wrong, at least enjoy it.
You can't be a winner and be afraid to lose.

------=_NextPart_000_0017_42A8EEC1.D2772C42
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4=2e0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3dContent-Type content=3d"text/html; charset=3dwindows-1=
250">
<META content=3d"MSHTML 6=2e00=2e2462=2e0000" name=3dGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3d#ffffff>
<DIV>What's so good about it? :)<BR>The early bird gets the worm=2e</DIV>=

<DIV><BR>Lwilton, looking for a place to get medicatitpon?<BR>Cheap ViagV=
Cra and Cialvgis=2e<BR>
Fast weight (nonenvious fantocine) loss and antidepressant medicatimfon!<=
BR>Best price on Valiuatm and XanaLjx=2e<BR>
Super deals, 80 pnceert off!<BR>We are able to ship wdrolwide<BR><BR>Here=
you will find it:<BR><A=20
href=3d"http://impertinent=2eselcydc=2ecom/d13/index=2ephp?id=3dd13">http=
://selcydc=2ecom/d13/index=2ephp?id=3dd13</A><BR>You are really anonymou=
s!</DIV>
<DIV><BR>When I was a kid my parents moved a lot, but I always found them=
=2e<BR>He that humbleth himself wishes to be exalted=2e</DIV></BODY></HTM=
L>

Re: They are getting harder to filter out... [ In reply to ]

adanks at calvin

Mar 5, 2004, 7:09 PM

Post #2 of 3 (494 views)

Permalink

Loren Wilton <lwilton <at> earthlink.net> writes:

>
> There doesn';t seem
> to be a whole lot to go on here.
>
> -----------------------------------------------
> Subject: Biggest meedication site on net, Lwilton! Exceptional offers for
> you!
> Greatest ViagWyra and Cialydis
> Quick weight (hemispheroidal plyers) loss and anti-depressant meedication!
> Best cost on ValiuuGm and XanaNnx
> Best deals, 80 pcenert off!
> You are completely anonymous!
>
> Cheap ViagV=
> Cra and Cialvgis=2e<BR>
> Fast weight (nonenvious fantocine) loss and antidepressant medicatimfon!<=
> BR>Best price on Valiuatm and XanaLjx=2e<BR>
> Super deals, 80 pnceert off!<BR>We are able to ship wdrolwide<BR><BR>Here=
> you will find it:<BR><A=20
> href=3d"http://impertinent=2eselcydc=2ecom/d13/index=2ephp?id=3dd13">http=
> ://selcydc=2ecom/d13/index=2ephp?id=3dd13</A><BR>You are really anonymou=

How about the following:
Valiu in the English dictionary is enough to nail Valium
antidepressant or anti-depressant
exceptional offers - I wonder how good this would do as a general rule
completely anonymous - same for this one
super deals, best deals

Someone who is good at writing rules could probably create a rule that checks
for too many superlatives: best, greatest, super, exceptional, biggest, quick,
completely - and increases the score depending on how many of these occur.

They could also probably get the
"Fast weight" followed by "loss" within x characters
"Biggest" followed by "site on net" or "web" within x characters

Are you running the antidrug rules?

Some of these might be decent rules
Some meta combinations of some of those should avoid FPs.

Al

Re: They are getting harder to filter out... [ In reply to ]

dbfunk at engineering

Mar 6, 2004, 12:53 AM

Post #3 of 3 (498 views)

Permalink

On Fri, 5 Mar 2004, Loren Wilton wrote:

> This puppy just made it through. Other than feeding it to Bayes (which I
> have just done) and some misspellings of common drugz, there doesn';t seem
> to be a whole lot to go on here.
[snip..]
>
> ------=_NextPart_000_0017_42A8EEC1.D2772C42
> Content-Type: text/plain
> Content-Transfer-Encoding: 7bit
>
> Well well!
> Liberty is the right to choose, freedom is the result of that choice.
> Lwilton, looking for a place to purchase medicatiQoxn?
> Greatest ViagWyra and Cialydis
> Quick weight (hemispheroidal plyers) loss and anti-depressant meedication!
> Best cost on ValiuuGm and XanaNnx
> Best deals, 80 pcenert off!
> We ship wlordwide
>
> Here you will find it:
> http://individualizingly.selcydc.com/d13/index.php?id=d13
> You are completely anonymous!
[snip..]
> ------=_NextPart_000_0017_42A8EEC1.D2772C42
> Content-Type: text/html
> Content-Transfer-Encoding: quoted-printable
>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4=2e0 Transitional//EN">
> <HTML><HEAD>
> <META http-equiv=3dContent-Type content=3d"text/html; charset=3dwindows-1=
> 250">
> <META content=3d"MSHTML 6=2e00=2e2462=2e0000" name=3dGENERATOR>
> <STYLE></STYLE>
> </HEAD>
> <BODY bgColor=3d#ffffff>
> <DIV>What's so good about it? :)<BR>The early bird gets the worm=2e</DIV>=
>
> <DIV><BR>Lwilton, looking for a place to get medicatitpon?<BR>Cheap ViagV=
> Cra and Cialvgis=2e<BR>
> Fast weight (nonenvious fantocine) loss and antidepressant medicatimfon!<=
> BR>Best price on Valiuatm and XanaLjx=2e<BR>
> Super deals, 80 pnceert off!<BR>We are able to ship wdrolwide<BR><BR>Here=
> you will find it:<BR><A=20
> href=3d"http://impertinent=2eselcydc=2ecom/d13/index=2ephp?id=3dd13">http=
> ://selcydc=2ecom/d13/index=2ephp?id=3dd13</A><BR>You are really anonymou=
> s!</DIV>

try these 3 rules:

uri L_MEDS_SITE /\bselcydc\.com\b/i
describe L_MEDS_SITE Web site associated with bogus meds sales
score L_MEDS_SITE 3.0

body L_BOGUS_QP /\b=2e(?:com|biz|info|net)[:\/]\b/
describe L_BOGUS_QP Bogus QuotedPrintable encoding
score L_BOGUS_QP 0.4

body L_FAKE_MEDS_6 /\bYou are {1,2}(?:completely|really|truely) anonymous!/
describe L_FAKE_MEDS_6 Phrase assocaited with fake MED scam #6
score L_FAKE_MEDS_6 4.3

Note, do NOT make the L_BOGUS_QP regex case insensitive (IE no /i at
end of regex). "=2E" is valid QP encoding, "=2e" is not. As that could be
produced by anybody's brain-dead mail client, I don't hit it too hard
(just want to add 'little cuts' to this piece of trash ;).

Put them in your local.cf or other '.cf' file in your SA rules directory.

--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{