You were correct. Thanks.
----- Original Message ----- From: "Bill Landry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, September 14, 2003 4:08 PM Subject: Re: [Declude.JunkMail] OBFUSCATION filter > He did share it with the list--possibly your filters blocked the message. > If you are not automatically deleting messages, check you hold queue, you > may find it there. > > Bill > ----- Original Message ----- > From: "Frederick Samarelli" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Sunday, September 14, 2003 12:49 PM > Subject: Re: [Declude.JunkMail] OBFUSCATION filter > > > > Would please share this filter. > > > > Thanks > > ----- Original Message ----- > > From: "Matthew Bramble" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Sunday, September 14, 2003 12:28 PM > > Subject: [Declude.JunkMail] OBFUSCATION filter > > > > > > > I put together a filter that checks for obfuscation of URL's, IP's and > > > text using URL encoding, HTML encoding, a mix of URL and HTML encoding, > > > Hexadecimal encoding, and octal encoding, though the latter two are > > > commented out due to a lack of current use by spammers. I've been > > > careful to allow hits only on combinations of either letters and numbers > > > or letters and numbers with HTTP address components in order to protect > > > from false positives. The technique is probably about the most > > > foolproof non-specific indicative indicator of spam that there is, and > > > should prove to be more reliable than most any other test out there. > > > > > > My results from a smattering of E-mail tested with this filter are as > > > follows: > > > > > > 805 - Unique Messages > > > 34 - Filter Hits (4.2%) > > > 0 - False Positives > > > 4 - Made a difference (would have scored within 50% of my fail > > > weight without the test) > > > 3 - Failed because of the test. > > > > > > I'm going to attach the file to a separate posting just in case some > > > people are already filtering for these techniques. I might suggest > > > trying not to include the text of the filter in replies, especially in > > > PM's direct to my account :) > > > > > > Special credit goes to Dan for leading me in the direction of > obfuscation. > > > > > > Matt > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
