Mailing List Archive

On Tue, 10 Feb 2004, Aleksander Adamowski <aleksander.adamowski.spamassassi...:

> It catches text where individual letters or pairs of letters are
> separated with a pipe or dot character.
>
> Any Comments?

http://www.emtinc.net/includes/chickenpox.cf

--
Brent J. Nordquist <b-nordquist@bethel.edu> N0BJN
Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html
* Fast pipe * Always on * Get out of the way - Tim Bray http://tinyurl.com/7sti

Hello Aleksander,

Tuesday, February 10, 2004, 3:57:16 AM, you wrote:

AA> I've just wanted to share my rule which is quite effective against spam
AA> that contains phrases in the type of
AA> "100 purcant M0ney Back G.u.a.r.a.n.t.e.e" or "|F|R|E|E| B0ttle W0rth
AA> Alm0st 60 d0llars!":

AA> rawbody PIPE_DOT_PUNCTUATION /([a-z][|.]+[a-z].{1,2}){2}/i
AA> describe PIPE_DOT_PUNCTUATION Body contains punctuation-obfuscated text
AA> lang pl describe PIPE_DOT_PUNCTUATION Tresc zawiera tekst znieksztalcony znakami interpunkcyjnymi
AA> score PIPE_DOT_PUNCTUATION 2.5 2.2 2.0 2.0

AA> It catches text where individual letters or pairs of letters are
AA> separated with a pipe or dot character.

Results here:

Section 3 -- Frequencies Log
(First numeric frequencies, followed by percentage frequencies)

OVERALL SPAM HAM S/O SCORE NAME
91185 73148 18037 0.802 0.00 0.00 (all messages)
12152 8907 3245 0.404 0.00 2.50 PIPE_DOT_PUNCTUATION

OVERALL% SPAM% HAM% S/O RANK SCORE NAME
91185 73148 18037 0.802 0.00 0.00 (all messages)
100.000 80.2193 19.7807 0.802 0.00 0.00 (all messages as %)
13.327 12.1767 17.9908 0.404 0.00 2.50 PIPE_DOT_PUNCTUATION

In other words, it hits a higher percentage of ham in my corpus than it
does spam.

It there a document somewhere that describes how to read these Frequency
Logs. I kind of get it, but not completely.
>
> Section 3 -- Frequencies Log
> (First numeric frequencies, followed by percentage frequencies)
>
> OVERALL SPAM HAM S/O SCORE NAME
> 91185 73148 18037 0.802 0.00 0.00 (all messages)
> 12152 8907 3245 0.404 0.00 2.50 PIPE_DOT_PUNCTUATION
>
> OVERALL% SPAM% HAM% S/O RANK SCORE NAME
> 91185 73148 18037 0.802 0.00 0.00 (all messages)
> 100.000 80.2193 19.7807 0.802 0.00 0.00 (all messages as %)
> 13.327 12.1767 17.9908 0.404 0.00 2.50
PIPE_DOT_PUNCTUATION
>
> In other words, it hits a higher percentage of ham in my corpus than
it
> does spam.
>
>