> -----Original Message----- > From: German Staltari [mailto:[EMAIL PROTECTED] > Sent: Thursday, July 10, 2003 10:53 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] tricky spam > > > Hi, i've attahced a very tricky SPAM mail that has been > scored with 0.8 > points, what can be done with this kind of SPAM?. > Thanks > German >
I had a rule note on this from before. Haven't got to it yet. Basicaly because of the FP rate. I'm going to write a few quick rules that look for letterzeroletter and letter1letter. You can see why the FP rate would be high. But I would score this low. possibly combine some of the rules. Like looking for multiple instances of the rule. It is easy to write a rule for some of the better knowns ones like /(f|ph)(o|0)t(o|0)/i but with all the ways of doing OBFU it would be kind of big. Your spam was a nice example. HTH Chris Santerre System Admin "You should never, never doubt what nobody is sure about."- Willy Wonka ------------------------------------------------------- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
