RE: *****SPAM***** Re: Ok - this is getting a little ridiculous.

[Chris Santerre <cs...@MerchantsOverseas.com>]

> -----Original Message-----
> From: Robert Lunnon [mailto:bobl@optushome.com.au]
> Sent: Thursday, February 05, 2004 3:10 AM
> To: spamassassin-users@incubator.apache.org
> Subject: *****SPAM***** Re: Ok - this is getting a little ridiculous.
> 
> 
> On Thursday 05 February 2004 15:59, Thomas Kinghorn wrote:
> > FVGT_b_VIAGRA       ?????
> >
> > Where is this rule?
> > I have looked in the emporium....must be overlooking it somewhere?
> >
> > Thanks
> >
> > Tom
> >
> > -----Original Message-----
> > From: Chris Santerre [mailto:csanterre@MerchantsOverseas.com]
> > Sent: 04 February 2004 11:47
> > To: 'Keith Dowell'; spamassassin-users@incubator.apache.org
> > Subject: RE: *****SPAM***** Ok - this is getting a little 
> ridiculous.
> >
> > > -----Original Message-----
> > > From: Keith Dowell [mailto:keith@rogersmfg.com]
> > > Sent: Wednesday, February 04, 2004 4:35 PM
> > > To: spamassassin-users@incubator.apache.org
> > > Subject: *****SPAM***** Ok - this is getting a little ridiculous.
> > >
> > >
> > > Here's one I just got that got through. Is there a blatant
> > > stupidity filter
> > > for this junk out there?
> > >
> > >
> > > On stock: ; v1@GRa , Pn.t.ermin > .Valium. . X@nax =3D 
> S0m@ & A`t|v@n
> > >    <p>
> > >    Plus: Tram@d:o|, U, L.3v|tra, Pr0:p3cia, Acyc|0vi`r,
> > > Pr0z@:c, P@`xil, B=
> > > u:sp@r, Ad|pe:x, I0`nam|n, M3ridi.a, X.3nica|, Ambi.3n,
> > > S0naT`a, Fl3xe'ril=
> >
> > ARGH! Since the site moved, I'm now filtering it. I have to 
> fix that!!! You
> > hit this (Notice this is including a NEGATIVE AWL!!!!)
> >
> > X-Spam-Status: Yes, hits=5.8 required=5.0
> > 	tests=AF_MEDICAMENTOS,AWL,FVGT_b_VIAGRA,MY_HELO,
> > 	      OACYS_DISGUISED_P0RN,RM_rb_PARA,SPAM_PHRASE_00_01
> >
> > X-Spam-Report:   5.80 hits, 5 required;
> >   *  0.3 -- May be valid but catches most.
> >   *  6.0 -- BODY: Tries to slip through filters by 
> substituting numbers for
> > letters
> >   *  2.5 -- BODY: Medicamento encontrado
> >   *  1.5 -- BODY: FVGT - mentions viagra
> >   *  0.8 -- BODY: Spam phrases score is 00 to 01 (low)
> >   *  0.0 -- BODY: Testing for HTML Paragraph in emails
> >   * -5.3 -- AWL: Auto-whitelist adjustment
> >
> > So give AF_MEDICAMENTOS and FVGT_b_VIAGRA a try.
> 
> Perhaps there needs to be a nn% mispelled rule or a "phrase makes no 
> grammatical sense" rule for those emails which include a list 
> of random 
> words !
> 
> Bob


body		FVGT_b_VIAGRA		/V[i1][a\@]gr[\@a]/i
describe	FVGT_b_VIAGRA		FVGT - mentions viagra
score		FVGT_b_VIAGRA		1.5

"phrase makes no grammatical sense" ahahahahha Half the stuff I type makes
no sense!!

--Chris (I'm loopy, I'm loopy....)

Re: *****SPAM***** Re: Ok - this is getting a little ridiculous.

[Robert Lunnon <bo...@optushome.com.au>]

On Friday 06 February 2004 01:39, Chris Santerre wrote:
> > -----Original Message-----
> > From: Robert Lunnon [mailto:bobl@optushome.com.au]
> > Sent: Thursday, February 05, 2004 3:10 AM
> > To: spamassassin-users@incubator.apache.org
> > Subject: *****SPAM***** Re: Ok - this is getting a little ridiculous.
> >
> > On Thursday 05 February 2004 15:59, Thomas Kinghorn wrote:
> > > FVGT_b_VIAGRA       ?????
> > >
> > > Where is this rule?
> > > I have looked in the emporium....must be overlooking it somewhere?
> > >
> > > Thanks
> > >
> > > Tom
> > >
> > > -----Original Message-----
> > > From: Chris Santerre [mailto:csanterre@MerchantsOverseas.com]
> > > Sent: 04 February 2004 11:47
> > > To: 'Keith Dowell'; spamassassin-users@incubator.apache.org
> > > Subject: RE: *****SPAM***** Ok - this is getting a little
> >
> > ridiculous.
> >
> > > > -----Original Message-----
> > > > From: Keith Dowell [mailto:keith@rogersmfg.com]
> > > > Sent: Wednesday, February 04, 2004 4:35 PM
> > > > To: spamassassin-users@incubator.apache.org
> > > > Subject: *****SPAM***** Ok - this is getting a little ridiculous.
> > > >
> > > >
> > > > Here's one I just got that got through. Is there a blatant
> > > > stupidity filter
> > > > for this junk out there?
> > > >
> > > >
> > > > On stock: ; v1@GRa , Pn.t.ermin > .Valium. . X@nax =3D
> >
> > S0m@ & A`t|v@n
> >
> > > >    <p>
> > > >    Plus: Tram@d:o|, U, L.3v|tra, Pr0:p3cia, Acyc|0vi`r,
> > > > Pr0z@:c, P@`xil, B=
> > > > u:sp@r, Ad|pe:x, I0`nam|n, M3ridi.a, X.3nica|, Ambi.3n,
> > > > S0naT`a, Fl3xe'ril=
> > >
> > > ARGH! Since the site moved, I'm now filtering it. I have to
> >
> > fix that!!! You
> >
> > > hit this (Notice this is including a NEGATIVE AWL!!!!)
> > >
> > > X-Spam-Status: Yes, hits=5.8 required=5.0
> > > 	tests=AF_MEDICAMENTOS,AWL,FVGT_b_VIAGRA,MY_HELO,
> > > 	      OACYS_DISGUISED_P0RN,RM_rb_PARA,SPAM_PHRASE_00_01
> > >
> > > X-Spam-Report:   5.80 hits, 5 required;
> > >   *  0.3 -- May be valid but catches most.
> > >   *  6.0 -- BODY: Tries to slip through filters by
> >
> > substituting numbers for
> >
> > > letters
> > >   *  2.5 -- BODY: Medicamento encontrado
> > >   *  1.5 -- BODY: FVGT - mentions viagra
> > >   *  0.8 -- BODY: Spam phrases score is 00 to 01 (low)
> > >   *  0.0 -- BODY: Testing for HTML Paragraph in emails
> > >   * -5.3 -- AWL: Auto-whitelist adjustment
> > >
> > > So give AF_MEDICAMENTOS and FVGT_b_VIAGRA a try.
> >
> > Perhaps there needs to be a nn% mispelled rule or a "phrase makes no
> > grammatical sense" rule for those emails which include a list
> > of random
> > words !
> >
> > Bob
>
> body		FVGT_b_VIAGRA		/V[i1][a\@]gr[\@a]/i
> describe	FVGT_b_VIAGRA		FVGT - mentions viagra
> score		FVGT_b_VIAGRA		1.5
>
> "phrase makes no grammatical sense" ahahahahha Half the stuff I type makes
> no sense!!

Well what you types at least follows some simple grammatical rules eg verbs 
and adjectives usually preceed your nouns, and you don't have a great list of 
nouns all together. Seems like a simple lexical analysis would put these ones 
to bed.

AFAIK if ya  typ shrt hnd 4 eva then IMHO u cud get a false +ve

Stil follows gramatical rules though if you can teach the lexical analyser the 
standard shorthand terms.

Bob