Mailing List Archive

RE: *****SPAM***** Re: Ok - this is getting a little ridiculous.
> -----Original Message-----
> From: Robert Lunnon [mailto:bobl@optushome.com.au]
> Sent: Thursday, February 05, 2004 3:10 AM
> To: spamassassin-users@incubator.apache.org
> Subject: *****SPAM***** Re: Ok - this is getting a little ridiculous.
>
>
> On Thursday 05 February 2004 15:59, Thomas Kinghorn wrote:
> > FVGT_b_VIAGRA ?????
> >
> > Where is this rule?
> > I have looked in the emporium....must be overlooking it somewhere?
> >
> > Thanks
> >
> > Tom
> >
> > -----Original Message-----
> > From: Chris Santerre [mailto:csanterre@MerchantsOverseas.com]
> > Sent: 04 February 2004 11:47
> > To: 'Keith Dowell'; spamassassin-users@incubator.apache.org
> > Subject: RE: *****SPAM***** Ok - this is getting a little
> ridiculous.
> >
> > > -----Original Message-----
> > > From: Keith Dowell [mailto:keith@rogersmfg.com]
> > > Sent: Wednesday, February 04, 2004 4:35 PM
> > > To: spamassassin-users@incubator.apache.org
> > > Subject: *****SPAM***** Ok - this is getting a little ridiculous.
> > >
> > >
> > > Here's one I just got that got through. Is there a blatant
> > > stupidity filter
> > > for this junk out there?
> > >
> > >
> > > On stock: ; v1@GRa , Pn.t.ermin > .Valium. . X@nax =3D
> S0m@ & A`t|v@n
> > > <p>
> > > Plus: Tram@d:o|, U, L.3v|tra, Pr0:p3cia, Acyc|0vi`r,
> > > Pr0z@:c, P@`xil, B=
> > > u:sp@r, Ad|pe:x, I0`nam|n, M3ridi.a, X.3nica|, Ambi.3n,
> > > S0naT`a, Fl3xe'ril=
> >
> > ARGH! Since the site moved, I'm now filtering it. I have to
> fix that!!! You
> > hit this (Notice this is including a NEGATIVE AWL!!!!)
> >
> > X-Spam-Status: Yes, hits=5.8 required=5.0
> > tests=AF_MEDICAMENTOS,AWL,FVGT_b_VIAGRA,MY_HELO,
> > OACYS_DISGUISED_P0RN,RM_rb_PARA,SPAM_PHRASE_00_01
> >
> > X-Spam-Report: 5.80 hits, 5 required;
> > * 0.3 -- May be valid but catches most.
> > * 6.0 -- BODY: Tries to slip through filters by
> substituting numbers for
> > letters
> > * 2.5 -- BODY: Medicamento encontrado
> > * 1.5 -- BODY: FVGT - mentions viagra
> > * 0.8 -- BODY: Spam phrases score is 00 to 01 (low)
> > * 0.0 -- BODY: Testing for HTML Paragraph in emails
> > * -5.3 -- AWL: Auto-whitelist adjustment
> >
> > So give AF_MEDICAMENTOS and FVGT_b_VIAGRA a try.
>
> Perhaps there needs to be a nn% mispelled rule or a "phrase makes no
> grammatical sense" rule for those emails which include a list
> of random
> words !
>
> Bob


body FVGT_b_VIAGRA /V[i1][a\@]gr[\@a]/i
describe FVGT_b_VIAGRA FVGT - mentions viagra
score FVGT_b_VIAGRA 1.5

"phrase makes no grammatical sense" ahahahahha Half the stuff I type makes
no sense!!

--Chris (I'm loopy, I'm loopy....)
Re: *****SPAM***** Re: Ok - this is getting a little ridiculous. [ In reply to ]
On Friday 06 February 2004 01:39, Chris Santerre wrote:
> > -----Original Message-----
> > From: Robert Lunnon [mailto:bobl@optushome.com.au]
> > Sent: Thursday, February 05, 2004 3:10 AM
> > To: spamassassin-users@incubator.apache.org
> > Subject: *****SPAM***** Re: Ok - this is getting a little ridiculous.
> >
> > On Thursday 05 February 2004 15:59, Thomas Kinghorn wrote:
> > > FVGT_b_VIAGRA ?????
> > >
> > > Where is this rule?
> > > I have looked in the emporium....must be overlooking it somewhere?
> > >
> > > Thanks
> > >
> > > Tom
> > >
> > > -----Original Message-----
> > > From: Chris Santerre [mailto:csanterre@MerchantsOverseas.com]
> > > Sent: 04 February 2004 11:47
> > > To: 'Keith Dowell'; spamassassin-users@incubator.apache.org
> > > Subject: RE: *****SPAM***** Ok - this is getting a little
> >
> > ridiculous.
> >
> > > > -----Original Message-----
> > > > From: Keith Dowell [mailto:keith@rogersmfg.com]
> > > > Sent: Wednesday, February 04, 2004 4:35 PM
> > > > To: spamassassin-users@incubator.apache.org
> > > > Subject: *****SPAM***** Ok - this is getting a little ridiculous.
> > > >
> > > >
> > > > Here's one I just got that got through. Is there a blatant
> > > > stupidity filter
> > > > for this junk out there?
> > > >
> > > >
> > > > On stock: ; v1@GRa , Pn.t.ermin > .Valium. . X@nax =3D
> >
> > S0m@ & A`t|v@n
> >
> > > > <p>
> > > > Plus: Tram@d:o|, U, L.3v|tra, Pr0:p3cia, Acyc|0vi`r,
> > > > Pr0z@:c, P@`xil, B=
> > > > u:sp@r, Ad|pe:x, I0`nam|n, M3ridi.a, X.3nica|, Ambi.3n,
> > > > S0naT`a, Fl3xe'ril=
> > >
> > > ARGH! Since the site moved, I'm now filtering it. I have to
> >
> > fix that!!! You
> >
> > > hit this (Notice this is including a NEGATIVE AWL!!!!)
> > >
> > > X-Spam-Status: Yes, hits=5.8 required=5.0
> > > tests=AF_MEDICAMENTOS,AWL,FVGT_b_VIAGRA,MY_HELO,
> > > OACYS_DISGUISED_P0RN,RM_rb_PARA,SPAM_PHRASE_00_01
> > >
> > > X-Spam-Report: 5.80 hits, 5 required;
> > > * 0.3 -- May be valid but catches most.
> > > * 6.0 -- BODY: Tries to slip through filters by
> >
> > substituting numbers for
> >
> > > letters
> > > * 2.5 -- BODY: Medicamento encontrado
> > > * 1.5 -- BODY: FVGT - mentions viagra
> > > * 0.8 -- BODY: Spam phrases score is 00 to 01 (low)
> > > * 0.0 -- BODY: Testing for HTML Paragraph in emails
> > > * -5.3 -- AWL: Auto-whitelist adjustment
> > >
> > > So give AF_MEDICAMENTOS and FVGT_b_VIAGRA a try.
> >
> > Perhaps there needs to be a nn% mispelled rule or a "phrase makes no
> > grammatical sense" rule for those emails which include a list
> > of random
> > words !
> >
> > Bob
>
> body FVGT_b_VIAGRA /V[i1][a\@]gr[\@a]/i
> describe FVGT_b_VIAGRA FVGT - mentions viagra
> score FVGT_b_VIAGRA 1.5
>
> "phrase makes no grammatical sense" ahahahahha Half the stuff I type makes
> no sense!!

Well what you types at least follows some simple grammatical rules eg verbs
and adjectives usually preceed your nouns, and you don't have a great list of
nouns all together. Seems like a simple lexical analysis would put these ones
to bed.

AFAIK if ya typ shrt hnd 4 eva then IMHO u cud get a false +ve

Stil follows gramatical rules though if you can teach the lexical analyser the
standard shorthand terms.

Bob