Mailing List Archive

Keith Dowell said:
> Here's one I just got that got through. Is there a blatant stupidity
> filter
> for this junk out there?
>
>
> On stock: ; v1@GRa , Pn.t.ermin > .Valium. . X@nax =3D S0m@ & A`t|v@n
> <p>
> Plus: Tram@d:o|, U, L.3v|tra, Pr0:p3cia, Acyc|0vi`r, Pr0z@:c, P@`xil,
> B=
> u:sp@r, Ad|pe:x, I0`nam|n, M3ridi.a, X.3nica|, Ambi.3n, S0naT`a,
> Fl3xe'ril=

I think Matt Kettler's Antidrug.cf should catch a bunch of those. You can
also try plugging the (non-obfuscated) drug names into CMOScript and add
the rulesfile it generates (see sig).

--
Chris Thielen

Easily generate SpamAssassin rules to catch obfuscated spam phrases
(0BFU$C/\TED SPA/\/\ P|-|RA$ES):
http://www.sandgnat.com/cmos/

FVGT_b_VIAGRA ?????

Where is this rule?
I have looked in the emporium....must be overlooking it somewhere?

Thanks

Tom

-----Original Message-----
From: Chris Santerre [mailto:csanterre@MerchantsOverseas.com]
Sent: 04 February 2004 11:47
To: 'Keith Dowell'; spamassassin-users@incubator.apache.org
Subject: RE: *****SPAM***** Ok - this is getting a little ridiculous.




> -----Original Message-----
> From: Keith Dowell [mailto:keith@rogersmfg.com]
> Sent: Wednesday, February 04, 2004 4:35 PM
> To: spamassassin-users@incubator.apache.org
> Subject: *****SPAM***** Ok - this is getting a little ridiculous.
>
>
> Here's one I just got that got through. Is there a blatant
> stupidity filter
> for this junk out there?
>
>
> On stock: ; v1@GRa , Pn.t.ermin > .Valium. . X@nax =3D S0m@ & A`t|v@n
> <p>
> Plus: Tram@d:o|, U, L.3v|tra, Pr0:p3cia, Acyc|0vi`r,
> Pr0z@:c, P@`xil, B=
> u:sp@r, Ad|pe:x, I0`nam|n, M3ridi.a, X.3nica|, Ambi.3n,
> S0naT`a, Fl3xe'ril=
>

ARGH! Since the site moved, I'm now filtering it. I have to fix that!!! You
hit this (Notice this is including a NEGATIVE AWL!!!!)

X-Spam-Status: Yes, hits=5.8 required=5.0
tests=AF_MEDICAMENTOS,AWL,FVGT_b_VIAGRA,MY_HELO,
OACYS_DISGUISED_P0RN,RM_rb_PARA,SPAM_PHRASE_00_01

X-Spam-Report: 5.80 hits, 5 required;
* 0.3 -- May be valid but catches most.
* 6.0 -- BODY: Tries to slip through filters by substituting numbers for
letters
* 2.5 -- BODY: Medicamento encontrado
* 1.5 -- BODY: FVGT - mentions viagra
* 0.8 -- BODY: Spam phrases score is 00 to 01 (low)
* 0.0 -- BODY: Testing for HTML Paragraph in emails
* -5.3 -- AWL: Auto-whitelist adjustment

So give AF_MEDICAMENTOS and FVGT_b_VIAGRA a try.

Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of the species that survives,
not the most intelligent, but the one most responsive to change.'
Charles Darwin

On Thursday 05 February 2004 15:59, Thomas Kinghorn wrote:
> FVGT_b_VIAGRA ?????
>
> Where is this rule?
> I have looked in the emporium....must be overlooking it somewhere?
>
> Thanks
>
> Tom
>
> -----Original Message-----
> From: Chris Santerre [mailto:csanterre@MerchantsOverseas.com]
> Sent: 04 February 2004 11:47
> To: 'Keith Dowell'; spamassassin-users@incubator.apache.org
> Subject: RE: *****SPAM***** Ok - this is getting a little ridiculous.
>
> > -----Original Message-----
> > From: Keith Dowell [mailto:keith@rogersmfg.com]
> > Sent: Wednesday, February 04, 2004 4:35 PM
> > To: spamassassin-users@incubator.apache.org
> > Subject: *****SPAM***** Ok - this is getting a little ridiculous.
> >
> >
> > Here's one I just got that got through. Is there a blatant
> > stupidity filter
> > for this junk out there?
> >
> >
> > On stock: ; v1@GRa , Pn.t.ermin > .Valium. . X@nax =3D S0m@ & A`t|v@n
> > <p>
> > Plus: Tram@d:o|, U, L.3v|tra, Pr0:p3cia, Acyc|0vi`r,
> > Pr0z@:c, P@`xil, B=
> > u:sp@r, Ad|pe:x, I0`nam|n, M3ridi.a, X.3nica|, Ambi.3n,
> > S0naT`a, Fl3xe'ril=
>
> ARGH! Since the site moved, I'm now filtering it. I have to fix that!!! You
> hit this (Notice this is including a NEGATIVE AWL!!!!)
>
> X-Spam-Status: Yes, hits=5.8 required=5.0
> tests=AF_MEDICAMENTOS,AWL,FVGT_b_VIAGRA,MY_HELO,
> OACYS_DISGUISED_P0RN,RM_rb_PARA,SPAM_PHRASE_00_01
>
> X-Spam-Report: 5.80 hits, 5 required;
> * 0.3 -- May be valid but catches most.
> * 6.0 -- BODY: Tries to slip through filters by substituting numbers for
> letters
> * 2.5 -- BODY: Medicamento encontrado
> * 1.5 -- BODY: FVGT - mentions viagra
> * 0.8 -- BODY: Spam phrases score is 00 to 01 (low)
> * 0.0 -- BODY: Testing for HTML Paragraph in emails
> * -5.3 -- AWL: Auto-whitelist adjustment
>
> So give AF_MEDICAMENTOS and FVGT_b_VIAGRA a try.

Perhaps there needs to be a nn% mispelled rule or a "phrase makes no
grammatical sense" rule for those emails which include a list of random
words !

Bob