John D. Hardin wrote:
On Wed, 4 Oct 2006, Eric A. Hall wrote:
On 10/4/2006 5:57 PM, Richard Doyle wrote:
I've been getting lots of porn site spam containing words with doubled
letters, like this one:
Can anybody suggest a rule or ruleset to catch these double-letter
obfuscations? I'm using Spamassassin 3.1.4.
You'd probably need to write a plug-in that used some kind of
typo-matching logic to find porno words.
/\bss?ee?xx?\b/i
/\boo?rr?gg?yy?\b/i
/\boo?rr?gg?ii?ee?ss?\b/i
Seeing same here; some targetted porn spam with doubled up letters in
the subject, usually scoring 2-3 due to various SA tests on rcvd lines,
with very short (2 line) bodies and urls that are not surbl and uribl or
dob (day old bread) listed yet. Typically they also include somewhat odd
adjectives, like audacious, immaculate, etc... I've just been reacting
with similar to what is suggested above, with some success, but it's got
me wondering if there isn't another list that I can find these on.
Ken Anderson
etc...
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
[EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED]
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
[Small arms] are fundamentally dangerous and their removal from the
equation either by control, neutralisation or removal is essential.
The first step is to gain information on their numbers and
whereabouts. -- the UN, who "doesn't want to confiscate guns"
-----------------------------------------------------------------------
