I posted a new version with the 3 new obfuscations.
----- Original Message ----- From: "Markus Gufler" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Tuesday, April 26, 2005 2:13 AM
Subject: RE: [Declude.JunkMail] Alternative drug spellings
Scott,
I'll go to try your tool. Looking at the filter file I can see a lot of
interesting "declude like" filter commands that looks very very interesting.
Maybe people at declude could give a look to this filter files...
In addition I want to add:
Maybe you can add the following replacements for obfusticating strings
"|<" => "K" "|{" => "K" ";" => "i"
Last question: What weighting system (hold weight) are you using? I asume your filter file is perpared for this hold weight.
Markus
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Monday, April 25, 2005 4:36 PM To: [email protected] Subject: Re: [Declude.JunkMail] Alternative drug spellings
I have an vb program that I run that de-obfuscates the subject line and runs it against a filter file. It'll catch lots of alternative drug spellings:
http://it.farmprogress.com/declude/obfsubj.htm
----- Original Message ----- From: "Dan Horne" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Monday, April 25, 2005 9:10 AM Subject: [Declude.JunkMail] Alternative drug spellings
Does anyone have a good, long filter file with a bunch of alternative spellings for the various drugs the spammers hawk? I know it is impossible to create a "comprehensive" list of them all, but if someone has a good start then I would love it if you could share it. We have been getting several of these that are just above our hold weight and I'd like to have a specific filter for this to pump it above the delete weight.
Thanks,
Dan Horne --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
