On Sat, 2 Aug 2003 13:29:54 -0700, "Gary Funck" <[EMAIL PROTECTED]> writes:
> Simple example:
>
> body REMOVE_OBFUSCATE
> /(Rem(o|0)ve|Delete).{0,10}y(o|0)ur.{0,10}(e[-]?mai(l|1)|address)/i
> describe REMOVE_OBFUSCATE Remove y0ur e-mail
>
> Above, this pattern will match (among other things):
> Remove your e-mail
> Rem0ve y0ur e-mai1
>
> where the second string has been obfuscated by replacing 'o' with '0' and
> 'l' with '1'.
>
> Let's say that I think the odds of a spam are higher if the
> obfuscated form is used, than when the regular form is used. Can you
> suggest a way to modify this pattern so that the pattern only
> matches obfuscated uses?
No; that would be nasty. But there's a very easy way that has the same
effect.
> Note: to meet my definition of obfuscated, only one of the
> substitutions above must appear. For example, Remove y0ur e-mail
> will suffice as an obfuscated form of "Remove your e-mail".
>
Set up two rules, one which matches all obfuscated&correct versions,
and a negative rule to undo it if everything is correct.
Using your example:
> body REMOVE_OBFUSCATE
> /(Rem[oO0]ve|De[lL1]ete).{0,10}y[oO0]ur.{0,10}([3e]-?mai[lL1]|[EMAIL PROTECTED])/i
> describe REMOVE_OBFUSCATE Remove y0ur e-mail
With a score of 5
One note, [abc] is much more efficient than (a|b|c), and its also
shorter.
> body REMOVE_OBFUSCATE_CORRECT
> /(Remove|Delete).{0,10}your.{0,10}(e-?mail|address)/i
> describe REMOVE_OBFUSCATE Remove y0ur e-mail
With a score of -4 or -5.
Anytime this negative rule matches, it must also match the above
positive rule, so this can either fully or partially cancel out the
above high score in the case of a correct spelling.
Scott
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
