Hello Matthew, Friday, April 22, 2005, 2:49:38 AM, you wrote:
MN> Hi, MN> Have had several spams over the last few days with the exact MN> paragraph below. Anyone else seen similar messages? Any rules MN> available? As suggested, if that paragraph is being repeated, Bayes is your friend. Agreed it may not do the whole job, but it's a big help. MN> Can't yet think of how to write rules for this, as it's so MN> non-spam it obviously is (of that makes any sense). I'll have a MN> think about it. It might be worth writing a rule that looks for a long phrase from the paragraph, one that won't normally occur in ham, like, body RULE_NAME /helpful to be lively and to vary the tone and/ MN> There is an HTML part, too, that is not included below. It doesn't MN> seem to say too much more than this paragraph though. However, there are frequently cues within the HTML tags themselves that could identify this as spam. Are you using any of SARE's HTML rule set files? See http://www.rulesemporium.com/rules.htm#html MN> Also, looking at the subject line, looks like the spammers are using the MN> technique of muddling all the middle letters of words but leaving the MN> first and last letters as normal. ISTR that some research recently MN> showed that people could understand words muddled up like this very MN> easily. Maybe it needs a new SA rule or plugin (don't know how this MN> would be done; would a plugin be needed?). Not a new trick -- we noticed it and discussed it a year or more ago. Tried a few general methods of identifying this, and it didn't work well. Based on a year's more experience in spam fighting, I have an idea or two that I'll play with and see if I can tackle this via some simple rules. No guarantees. If anyone has additional examples of such misspleled words, please send them to me offlist. Bob Menschel
