From: "Raymond Dijkxhoorn" <raym...@prolocation.net>
Sent: Sunday, 2009/October/11 02:48
Hi!
7263 T_CN_URL hits in 15517 spam corpus
7200 T_CN_8_URL hits in 15517 spam corpus
Does this make any sense? This is funny. Could someone add this rule
to the sandbox? I'm just curious.
I have to admire one thing about spammers. They respond very rapidly to
"threats" to their ability to break through spam protection software. You
became curious and mentioned this on the date above. Spammers are already
using <7 character names>.cn.
Thats why i said earlier in the thread if you see something, test it
silently and add it silently. Thats the only way to get use of it.
We use some rules if we talk open about it and say hey this spammer is
stupid look here, then it will take less then 12 hours and that gap is
closed and we loose a valuable trick.
Fighting spam is more then just ventilating idea's its much more then
that.
Bye,
Raymond.
Some years ago, Raymond, I "used" this list to bait a specific spammer
about how pathetic his scores were. They were high but he didn't break
100. Within a week he found a way. (His spams had (have) many features
that very characteristic of his work but hard to use for anti-spam.
This involved a specific portion of a name he'd use for registering his
phony domains.)
So I am quite aware of losing good rules. HOWEVER, as he found out WE
keep the old rules and add new ones and his keyhole through which he
could squeeze his spam decreased. It's still decreasing, although at a
slower rate due to the relative inactivity of the SARE ninjas.
{^_^}
