why not write your own rules as extension? I have some 500+ rules to stay (ahead|close) to spammers...
ie.: rawbody RAWBODY_PORN_OBFUS_01 /(\$ex|pr0n|p0rn|t(\||\!|1|í|ì|î)t|fvck|a\$\$|cl(\||\!|1|í|ì|î)t|c0ck|pen(\| |\!|1|í|ì|î)(s|$)|b0y|d(\||\!|1|í|ì|î)ck|(\||\!|1|í|ì|î)nche?s?|erect(\||\!| 1|í|ì|î)on|(guarante(é|è|ê)d|guarant(é|è|ê)ed))/i score RAWBODY_PORN_OBFUS_01 8.3 describe RAWBODY_PORN_OBFUS_01 Porn indication (and obfuscates it) rawbody RAWBODY_PORN_OBFUS_02 /\b([A-Z]+[$|!il0][A-Z]|[A-Z]+[$|!il0][A-Z]+)\b/ describe RAWBODY_PORN_OBFUS_02 Porn indication (and obfuscates it) Version 2 score RAWBODY_PORN_OBFUS_02 4.4 cheerio "Per Björklund" <[EMAIL PROTECTED]> schrieb im Newsbeitrag news:[EMAIL PROTECTED] I don't understand those spammers... If I have a spamfilter, that probably (certainly!) means I'm not interested in what they offer. Why go through all that trouble to avoid them? ;) Anyway.. I have received a couple (over 20) of spam lately which looks almost exactly like the one pasted below. All of them scored lower than 5 (the example attached scored only 1.4). When running through spamassassin -D it said that the bayes score was 0.596075661108193, which I presume is because of the confusing words in the html comments and in the "almost-hidden" text (font color is almost the same as background).. Btw.. I saw earlier on this list someone suggesting "degappyfying" text before running through tests.. Couldn't a "de3133+ing" be done before running some tests to avoid all those p0rn, rem0ve, e-mai1? (Well, bayes could of course pick those up after I run them through sa-learn, but there are many ways to spell a word "wr0ng") / Per Received: from 62.163.253.41 (a253041.upc-a.chello.nl [62.163.253.41]) by itlinkgw.itlink.se (8.12.3/8.12.3/Debian-6.4) with SMTP id h519utC2026277 for <[EMAIL PROTECTED]>; Sun, 1 Jun 2003 11:56:56 +0200 Date: Mon, 02 Jun 2003 00:13:24 GMT From: Naudian Caudibertia <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] X-Priority: 3 (Normal) Message-ID: <[EMAIL PROTECTED]> Subject: Young college gir1es ____I____I___(sunshine gardens begins) MIME-Version: 1.0 Content-type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Accept-Language: en-us, en X-Mailer: Mutt 1.0us X-Priority: 3 (Normal) X-Spam-Score: 1.4, DATE_IN_FUTURE_12_24,HTML_50_60,HTML_FONT_BIG,HTML_FONT_COLOR_BLUE,HTML_FONT _COLOR_RED,HTML_FONT_COLOR_UNSAFE,MIME_HTML_ONLY X-Spam-Status: No, hits=1.4 required=5 X-Scanned-By: MIMEDefang 2.31 (www . roaringpenguin . com / mimedefang) Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 01 Jun 2003 09:53:50.0609 (UTC) FILETIME=[B40AF810:01C32823] <html> <body> <table width="100%" height="100%" bgcolor="#413333" cellpadding=30> <tr valign="top"><td align="center"> <font color="#423939">foreign its Canary</font> <table width="450" cellpadding=10> <tr><td> <br> <font color="yellow" size=5><b> College <!--yet-and gilding-->Brats</b></font> <br> <font color="#423939">Magpie Fish-Footman NOT</font><br> <font color="white" size=3> College <!--steep curiouser-->Brats is dedicated to young, horny gir1s 18-19 <br> with huge appetite for cock and pussy. <br> <font color="#423939">scratched very fill</font> <br> Find out what these naughty angels do after college classes. <br> <font color="#423939">adopted shooting ornament</font> <br> Inside you will find top quality photos and videos and a lot of eXtras!<br> <br> <font color="#423939">readily INSIDE farm-yard</font> <br> <a href="http://Qmh1l7bvTf.soskam.net/collegebrats/index.html?Hn5Rot";> <font color="yellow" size=5><b>Enter site here</b></font></a><br> <br><br><br> </td></tr> </table> <font color="#423939">means factory patiently</font><br> <p align="left"> <table width="350" bgcolor="#201010" cellpadding=5> <tr><td> <center> <font color="#a1a2a3" size=2><b>Rem0ve/Add your e-mai1 fr0m/to our database!</b></font> <br> <a href="http://850q21j2.soskam.net/index.html?t3t8ZR0";><font color="#818284" size=2><b>:: Rem0ve/Add e-mai1 here ::</b></font></a> </td></tr> </table> <font color="#423939"> disagree confusion hop-tendrils<br> recalled choose surround</font> </td></tr> </table> </body> </html> ------------------------------------------------------- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ------------------------------------------------------- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
