Yep, you're right, it's not new. This very behavior is the reasoning behind the "GAPPY_TEXT" rule.

Unfortunately GAPPY_TEXT has issues which give it horrible statistics, thus a low score...

From 2.43's STATISTICS.txt

OVERALL%   SPAM% NONSPAM%     S/O    RANK   SCORE  NAME
1.421    2.233    1.262    0.64    0.35    0.01  GAPPY_TEXT

So while it's been identified as a problem, there's no current rule for it.

However in 2.50, bayes will eat this kind of stuff for lunch with the greatest of ease.

I'd venture to guess that v.i.a.g.r.a is not a very statistically common pattern in nonspam and one easily recognized by bayes type tokenization :)


At 07:30 PM 2/6/2003 +0000, Martin Radford wrote:
Hi all,

Well, this probably isn't a new trick, but it's the first time I've
noticed it:

  Here is your chance to skip the embarrassing, time-consuming task of
  going to d.octor's appointments to try and get the p.rescription you
  want.  We're ready to Fedex your online v_i a g r_a p.rescription
  orders right now!!!

  No p.rescription necessary!!! Just visit the link below and have your
  v_i a g r_a on its way to you today!!!
  http://www.TropicalPills.com/main2.php?rx=17283

Note the "d.octor's", "p.rescription", "v_i a g r_a".

Grepping 2.50 and 2.43 don't reveal checks for "doctor",
"prescription", or "viagra" (in lower case), but the way the spammer
has tried to obfuscate these words indicate that s/he is trying to
get round simple text matching rules.

Martin
--
Martin Radford              |   "Only wimps use tape backup: _real_
[EMAIL PROTECTED] | men just upload their important stuff  -o)
Registered Linux user #9257 |  on ftp and let the rest of the world  /\\
- see http://counter.li.org |       mirror it ;)"  - Linus Torvalds _\_V



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk



------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to