Hello Markus, Friday, September 5, 2003, 6:23:00 AM, you wrote:
MG> I just got a spam mail containg a remove link, but it was written MG> like this: "r3moV3" and spamassassin missed it. MG> Maybe this should be added as a keyword. It also contained "Penís" MG> (note the i is written as í), which also wasn't detected. That's because these specific spamsigns aren't yet encoded into your installation of SpamAssassin. Many of us already have rules which would have caught the P sign. Your R sign is new to me, and doesn't match any of the spam in my archive yet. Thanks for the pointer -- I'm adding it to my system, along with r3move and remov3, as well as m0ve and m0v3. It'll identify spam when the first example reaches me. Head for http://www.exit0.us/index.php/MaskedWordList and you'll see the list we've been developing. I've just added your new remove word(s) to the list. Please feel free to add any additional ones you come across. These words then get combined into rules which we use to identify spam. Yours have been added to one of my rules: > body RM_b_MaskedW0rdsd /(?:m0ve|m0v3|mov3|r3move|[EMAIL PROTECTED]|[EMAIL > PROTECTED])/i > describe RM_b_MaskedW0rdsd masked spam word(s): remove, pharmacy, patients > score RM_b_MaskedW0rdsd 7.1 # 114 spam, 0 ham, Sep 5 2003 Better would be to develop generic rules which identify masked words (my term for this class of spam trick) without knowing what the words themselves are. The trick is to manage that without causing false positives among valid emails which point to web pages with strange names, which contain emailed passwords, or which match "creative" company or brand names (watch out for 3M). If you have ideas along those lines, we'd all be glad to contribute to that effort. Bob Menschel ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
