You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Aleksander Adamowski <al...@altkom.pl> on 2004/02/10 12:57:16 UTC
Rule for punctuation-obfuscated body
Hi!
I've just wanted to share my rule which is quite effective against spam
that contains phrases in the type of
"100 purcant M0ney Back G.u.a.r.a.n.t.e.e" or "|F|R|E|E| B0ttle W0rth
Alm0st 60 d0llars!":
rawbody PIPE_DOT_PUNCTUATION /([a-z][|.]+[a-z].{1,2}){2}/i
describe PIPE_DOT_PUNCTUATION Body contains punctuation-obfuscated text
lang pl describe PIPE_DOT_PUNCTUATION Tresc zawiera tekst znieksztalcony znakami interpunkcyjnymi
score PIPE_DOT_PUNCTUATION 2.5 2.2 2.0 2.0
It catches text where individual letters or pairs of letters are
separated with a pipe or dot character.
Any Comments?
Re: Rule for punctuation-obfuscated body
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Aleksander,
Tuesday, February 10, 2004, 3:57:16 AM, you wrote:
AA> I've just wanted to share my rule which is quite effective against spam
AA> that contains phrases in the type of
AA> "100 purcant M0ney Back G.u.a.r.a.n.t.e.e" or "|F|R|E|E| B0ttle W0rth
AA> Alm0st 60 d0llars!":
AA> rawbody PIPE_DOT_PUNCTUATION /([a-z][|.]+[a-z].{1,2}){2}/i
AA> describe PIPE_DOT_PUNCTUATION Body contains punctuation-obfuscated text
AA> lang pl describe PIPE_DOT_PUNCTUATION Tresc zawiera tekst znieksztalcony znakami interpunkcyjnymi
AA> score PIPE_DOT_PUNCTUATION 2.5 2.2 2.0 2.0
AA> It catches text where individual letters or pairs of letters are
AA> separated with a pipe or dot character.
Results here:
Section 3 -- Frequencies Log
(First numeric frequencies, followed by percentage frequencies)
OVERALL SPAM HAM S/O SCORE NAME
91185 73148 18037 0.802 0.00 0.00 (all messages)
12152 8907 3245 0.404 0.00 2.50 PIPE_DOT_PUNCTUATION
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
91185 73148 18037 0.802 0.00 0.00 (all messages)
100.000 80.2193 19.7807 0.802 0.00 0.00 (all messages as %)
13.327 12.1767 17.9908 0.404 0.00 2.50 PIPE_DOT_PUNCTUATION
In other words, it hits a higher percentage of ham in my corpus than it
does spam.
Re: Rule for punctuation-obfuscated body
Posted by "Brent J. Nordquist" <b-...@bethel.edu>.
On Tue, 10 Feb 2004, Aleksander Adamowski <aleksander.adamowski.spamassassi...:
> It catches text where individual letters or pairs of letters are
> separated with a pipe or dot character.
>
> Any Comments?
http://www.emtinc.net/includes/chickenpox.cf
--
Brent J. Nordquist <b-...@bethel.edu> N0BJN
Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html
* Fast pipe * Always on * Get out of the way - Tim Bray http://tinyurl.com/7sti