You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Scott Williams , Area4" <sw...@area4.k12.il.us> on 2004/04/23 17:01:36 UTC
drug filters leaking.
I use all of the common antidrug filters at the SARE rules emporium
how did this one slip by? I'm hoping someone can beef up the filter on the
next go around. Thanks
Sneakiy Spam below:
Date: Thu, 22 Apr 2004 20:26:31 +1000
Reply-To: "jeramy armour" <ye...@changeplace.com>
From: "jeramy armour" <ye...@changeplace.com>
User-Agent: Pegasus Mail for Win32 (v3.12a)
Subject: Clythfro Str0ng Pain Meds, bvy them 0n1ine quick and easy
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
smtp1.area4.k12.il.us
X-Spam-Status: No, hits=1.6 required=3.5 tests=BAYES_40,DATE_IN_PAST_03_06,
FVGT_rtbl_CBL,J_CHICKENPOX_32,RCVD_IN_RFCI autolearn=no version=2.63
X-Spam-Level: *
X-OriginalArrivalTime: 22 Apr 2004 13:35:10.0647 (UTC)
FILETIME=[A23A7470:01C4286E]
banks bank-america bank-arizona
We make it easier and faster than ever to get the prescriptions you need
..
V*ico*dinPain Killers
We ship WORLDWIDE!... No forms to fill out... We respect your Privacy
F T http://avenueofthestarts.info/wdj/
No more: http://avenueofthestarts.info/mct/rm.html
A guy is taking a walk and sees a frog on the side of the road. As he comes
closer, the frog starts to talk. "Kiss me and I will turn into a princess."
The guy picks the frog up and puts it in his pocket. The frog starts
shouting, "Hey! Didn't you hear me? I'm a Princess. Just kiss me and I will
be yours." The guy takes the frog out of his pocket and smiles at it and
puts it back. The frog is really frustrated. "I don't get it. Why won't you
kiss me? I will turn into a beautiful princess and do anything you ask." The
guy says, "Look, I'm a computer geek. I don't have time for girls. But a
talking frog is cool.!"
A young man saw an elderly couple sitting down to lunch at McDonald's. He
noticed that they had ordered one meal, and an extra drink cup. As he
watched, the older gentleman carefully divided the hamburger in half, then
counted out the fries, one for him, one for her, until each had half of
them. Then the old man poured half of the soft drink into the extra cup and
set that in front of his wife. The old man then began to eat, and his wife
sat watching, with her hands folded in her lap. The young man decided to ask
if they would allow him to purchase another meal for them so that they
didn't have to split theirs. The old gentleman said, "Oh, no. We've been
married 50 years, and everything has always been and will always be shared,
50/50." The young man then asked the wife if she was going to eat, and she
replied, "Not yet. It's his turn with the teeth.
bussyu3busu03busubusu,busui busuta.
Scott Williams, CCNA
Ph: 217-893-1431
Em: swilliams@area4.k12.il.us
Website: www.area4.k12.il.us
Area 4 Technology Center
200 S. Fredrick, Suite 305
Rantoul, IL 61866
Re: drug filters leaking.
Posted by Jeff Chan <je...@surbl.org>.
On Friday, April 23, 2004, 8:01:36 AM, Area4 Scott Williams wrote:
> I use all of the common antidrug filters at the SARE rules emporium
> how did this one slip by? I'm hoping someone can beef up the filter on the
> next go around. Thanks
> Sneakiy Spam below:
> Date: Thu, 22 Apr 2004 20:26:31 +1000
> Reply-To: "jeramy armour" <ye...@changeplace.com>
> From: "jeramy armour" <ye...@changeplace.com>
> User-Agent: Pegasus Mail for Win32 (v3.12a)
> Subject: Clythfro Str0ng Pain Meds, bvy them 0n1ine quick and easy
> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
> smtp1.area4.k12.il.us
> X-Spam-Status: No, hits=1.6 required=3.5 tests=BAYES_40,DATE_IN_PAST_03_06,
> FVGT_rtbl_CBL,J_CHICKENPOX_32,RCVD_IN_RFCI autolearn=no version=2.63
> X-Spam-Level: *
> X-OriginalArrivalTime: 22 Apr 2004 13:35:10.0647 (UTC)
> FILETIME=[A23A7470:01C4286E]
> banks bank-america bank-arizona
> We make it easier and faster than ever to get the prescriptions you need
> ..
> V*ico*dinPain Killers
> We ship WORLDWIDE!... No forms to fill out... We respect your Privacy
> F T http://avenueofthestarts-MUNGED.info/wdj/
> No more: http://avenueofthestarts-MUNGED.info/mct/rm.html
...
It has 54+ SpamCop URI reports, so it's on sc.surbl.org:
top-sites.txt:2004-04-23 06:10 54 ./domains/info/avenueofthestarts/index.txt
http://www.surbl.org/
Jeff C.
Re: drug filters leaking.
Posted by Matt Kettler <mk...@evi-inc.com>.
At 11:01 AM 4/23/2004, Scott Williams , Area4 wrote:
>I use all of the common antidrug filters at the SARE rules emporium
>how did this one slip by? I'm hoping someone can beef up the filter on
>the next go around. Thanks
>
>Sneakiy Spam below:
<snip>
>V*ico*dinPain Killers
It slipped by because antidrug is looking for a word resembling vicodin.
However, it's not looking for a word containing 4 extra arbitrary letters
appended to the end. By leaving the space out they've dodged DRUGS_PAIN and
DRUGS_PAIN_OBFU.
I'll have to think about how to handle that without risking excessive FPs...
I could remove the (?:\b|\s) requirement from the end of the rule, but
they'd just shove a word at the start too.