Rules for that mutating subject drug mails

[Eduardo Bejar <wo...@linkabu.net>]

Hi,

I´d like to know if it´s possible to filter efficiently all those emails
about Viagra and friends with a subject that always changes and has
different letters inserted between the letters of the drug name. I guess you
know which ones I´m talking about (Re: test VhtAGGRA / CItAlLIS).

Currently my spamassassin stops some of them, but there are others that keep
getting through (with a 4/6 spam score), so I´d like to know what you guys
have done regarding this messages.

Thanks!

Edo

RE: Rules for that mutating subject drug mails

[Bret Miller <br...@wcg.org>]

> I´d like to know if it´s possible to filter efficiently all 
> those emails
> about Viagra and friends with a subject that always changes and has
> different letters inserted between the letters of the drug 
> name. I guess you
> know which ones I´m talking about (Re: test VhtAGGRA / CItAlLIS).
> 
> Currently my spamassassin stops some of them, but there are 
> others that keep
> getting through (with a 4/6 spam score), so I´d like to know 
> what you guys have done regarding this messages.

That's mostly "geocities" spam. I use the KAM_GEO_STRING2 from
http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf to deal
with it. Beware though, this rule catches ALL geocities URI's, so it can
FP easily if someone you know has a real geocities web site. (We haven't
had a FP yet, so apparently no one here knows anyone with a geocities
web site.) Bayes is beginning to be helpful, but the messages mutate so
much that it's not of any real use for catching new versions.

Bret