Sorry to say I tried something like this already - it hit every we got an
email order with a credit card number in it, or any string of numbers for
that matter. Even if you added numbers to the list (/[^aeiou0-9]/), it
would still hit on your PGP signature below, on strings like "http:", etc.
I'm playing with Chris's OBFU rules, but I'll keep watching the list for
more ideas, too - I'd love to be able to catch these!
Sandy S.
----- Original Message -----
From: "Daniel Carrera" <[EMAIL PROTECTED]>
To: "SpamAssassin list" <[EMAIL PROTECTED]>
Sent: Friday, July 25, 2003 3:41 PM
Subject: Re: [SAtalk] spam funny
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Ahhh... you mean *that* kind of funny...
> When I saw your title I was hoping for a chuckle.
>
> Sorry, I can't think of any rule to vix those. I'd be interested in one
> because I've received some of those too.
>
> Here is a thought: We could test for n consecutive consonants. The more
> consecutive consotants, the more likely it is to be spam.
>
> body MY_CONSONANT_4 /[^aeiou]{4}/
> describe MY_CONSONANT_4 Body contains 4 consecutive consonants.
> score MY_CONSONANT_4 0.15
>
> Like wise we can go on with more consonants:
>
> score MY_CONSONANT_4 0.15
> score MY_CONSONANT_5 0.30
> score MY_CONSONANT_6 0.60
> score MY_CONSONANT_7 1.20
> score MY_CONSONANT_8 2.40
>
> Remember, thesee are adding up, so if an email has 8 consecutive
> consonants, it will receive an score of 2*2.4 - 0.15 == 4.65
>
> Your sample below has up to 11 consecutive consonants.
>
> Any thoughts on these rules? I guess I'm assuming that you don't get
> emails in German.
>
> Cheers,
> Daniel.
>
> On Fri, Jul 25, 2003 at 11:25:55AM +0200, Andrea Riela wrote:
> > Hi folks,
> >
> > I receive a lot of spam (html or text only) that has at the end a funny
> > expression, always different, like this:
> >
> > acxfic z fvddx n th r j eghqyxun hlchd rpk zgrxlkd
> > bqnkstszzwyoyh heljsi
> > r
> >
> > Could I filter this spam? And if yes, how? Advices?
> > Thanks for all
> > Best Regards
> > Andrea Riela
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> > Data Reports, E-commerce, Portals, and Forums are available now.
> > Download today and enter to win an XBOX or Visual Studio .NET.
> >
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> > _______________________________________________
> > Spamassassin-talk mailing list
> > [EMAIL PROTECTED]
> > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
>
> - --
> Daniel Carrera | OpenPGP fingerprint:
> Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88
> UMD, College Park | http://www.math.umd.edu/~dcarrera/pgp.html
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (SunOS)
>
> iD8DBQE/IZYRnxE8DWHf+OcRAnXMAKCVY2A9VX/4K28Z85sNMjwpEzcL/wCcC7NE
> N2E/j5hAWmcFFbZCQHc/z5w=
> =jUfE
> -----END PGP SIGNATURE-----
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
>
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
>
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
