I made a few custom rules looking for intentional misspellings of certain 
subject words.  We use Bayes, so of course the misspellings are soon recognized 
that way too.

The rules I made are based on the observation that the first and last letters 
of these obfuscated words are left alone to make them understandable.  So a 
5-letter word will have 6 possible variations, of which 5 are misspellings.  
Since these misspellings are highly unlikely to occur in ham, you can score 
them pretty high.

So for this word you could use:

header PT_SPELL1      Subject =~ /\bh(ron|onr|nro|nor|rno)y\b/i

Of course 6-letter and longer words have more possible misspellings, so you 
can't extend this method too far!  Other misspelled subject words I see in 
today's quarantine include "pretty", "lovely", and "mother".

Good luck
Pierre Thomson
BIC



-----Original Message-----
From: Gray, Richard [mailto:[EMAIL PROTECTED]
Sent: Monday, February 21, 2005 8:28 AM
To: Jeff Chan; Daniel A. de Araujo
Cc: users@spamassassin.apache.org
Subject: RE: ENC: Wet 30 to 40 girls hrony and wants you


I have this same SPAM regularly occuring in our network, and frequently
the domain has yet to be listed in the SURBL lists.

I have yet to find another effective way of catching this other than
writing a long list of rules to match the varying subject lines 

-----Original Message-----
From: Jeff Chan [mailto:[EMAIL PROTECTED] 
Sent: 21 February 2005 13:02
To: Daniel A. de Araujo
Cc: users@spamassassin.apache.org
Subject: Re: ENC: Wet 30 to 40 girls hrony and wants you

On Monday, February 21, 2005, 4:45:38 AM, Daniel Araujo wrote:
> Hi, guys. We are receiving a lot of kind these spams below. I couldnt 
> discover a way to block them because there are o lot of types and 
> combinations. Does someone is having the same problem ? Any ideas to 
> block it ?

>  -----Mensagem original-----
> De: Sweetest S. Transfusion [mailto:[EMAIL PROTECTED] Enviada 
> em: domingo, 20 de fevereiro de 2005 00:06
> Para: Angelac
> Assunto: Fw: Wet 30 to 40 girls hrony and wants you


> Buenos tardes!

> Bandagi

Reply via email to