On Wednesday, August 25, 2004, 2:11:47 PM, Scott wrote: SF> Are there any rules in place to deal with this obfuscation?
SF> Sec. tion SF> 2. 7, A o, f the Sec, urities A, ct of 19. 33 and Se.ction 2. 1B SF> of the Se. curities Excha. nge A, ct of 19. 34. Yes... When we get a pump and dump spam we look for obfuscations like this and code rules to capture similar cases. For instance, a good candidate here would be: "sec,_+urities~+_se.ction" These two patterns appearing on the same line are "statistically unique" to spam - or at least that would be my hypothesis. This technique is largely effective, but there is a lot of room for new variants and we must see them to code them. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
