Thanks ----- Original Message ----- From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, September 12, 2003 5:15 PM Subject: Re: [Declude.JunkMail] Gibberish body detector + inline Base64
> Frederick Samarelli wrote: > > >Do you this in addition to or in replace of the tested listed earlier. > > > > It's completely separate from the GIBBERSUB filter. I updated the list > of keywords in the subject filter so that it is the same as the one I > just posted after finding FP's on the acronym 'QE'EG (Quantitative > Electroencephalogram) and bamboo'zl'e. Depending on how you score it, > that might not matter all that much. > > My latest version of GIBBERSUB is attached. I started dating them > whenever I make changes in the even that helps anyone that wants to use > them. > > You also might want to whitelist declude.com if you are using these > filters :) > > Matt > ---------------------------------------------------------------------------- ---- > # GIBBERISHSUB > # 09/11/2003 > # > # Description: > # Built to look for random strings of text (gibberish) in the subject of a message by searching > # for character combinations that aren't common in E-mail communications. Will be triggered on > # any Base64 encoding due to the code marker used to tell the mail client to display the proper > # character set. A negative weight for the same code marker defeats the test in order to > # protect from false positives on the encoded content. > # > # Usage: > # GIBBERISHSUB filter C:\IMail\Declude\GibberishSub.txt x 5 0 > # > # False Positives: > # Very rare. Would be primarily attributed to randomly generated codes, acronyms and > # misspellings. > > > # The following defeats the test if it finds the subject is not sent as ASCII > > SUBJECT -5 CONTAINS ?b? > > > # Small list of letter combinations not found in a basic dictionary. > > SUBJECT 0 CONTAINS qb > SUBJECT 0 CONTAINS qc > SUBJECT 0 CONTAINS qd > SUBJECT 0 CONTAINS qf > SUBJECT 0 CONTAINS qg > SUBJECT 0 CONTAINS qh > SUBJECT 0 CONTAINS qi > SUBJECT 0 CONTAINS qj > SUBJECT 0 CONTAINS qk > SUBJECT 0 CONTAINS qm > SUBJECT 0 CONTAINS qn > SUBJECT 0 CONTAINS qo > SUBJECT 0 CONTAINS qp > SUBJECT 0 CONTAINS qr > SUBJECT 0 CONTAINS qs > SUBJECT 0 CONTAINS qt > SUBJECT 0 CONTAINS qv > SUBJECT 0 CONTAINS qx > SUBJECT 0 CONTAINS qy > SUBJECT 0 CONTAINS qz > > SUBJECT 0 CONTAINS vq > SUBJECT 0 CONTAINS wq > SUBJECT 0 CONTAINS tq > SUBJECT 0 CONTAINS jq > > SUBJECT 0 CONTAINS xd > SUBJECT 0 CONTAINS xj > SUBJECT 0 CONTAINS xk > SUBJECT 0 CONTAINS xr > SUBJECT 0 CONTAINS xz > > SUBJECT 0 CONTAINS zb > SUBJECT 0 CONTAINS zc > SUBJECT 0 CONTAINS zf > SUBJECT 0 CONTAINS zj > SUBJECT 0 CONTAINS zk > SUBJECT 0 CONTAINS zm > SUBJECT 0 CONTAINS zx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
