RE: [SAtalk] How detect messages like these?

Tue, 27 May 2003 09:16:25 -0700 

Strange enough, but there are many languages in the world that don't look
like english,
and people use them every day to send ham to each other...

I believe rules like :

/z(j|b|x)/i
/j(z|x|b)/i

match many polish words. 

Not that I know much about that language, but :

grep zb /usr/share/dict/polish|wc -l -> 17249
zj -> 6649
zx -> 0 (hehe)
jz -> 813
jx -> 0
jb -> 597


And not talking about all languages I do not have a single clue about, 
and may use those occurences in everyday talks.

So I don't think those two letters combinations are a very good idea.
I would suggest matching more than 2 letters at a time, and even then, 
checking combinations against "plenty of" dictionnaries would seem a 
prerequiste to me.


My 2 cents,

Vincent


-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 27, 2003 4:16 PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: Re: [SAtalk] How detect messages like these?



Thanks for the reply.

Any chance SA could include these sorts of rules (especially the one about
letters that don't belong together in english) as part of the default set of
rules?

I don't really know how to setup my own rules, how would I do what you
described below?

Thanks
Ricardo

On Tue, 27 May 2003 10:09:24 -0400 Chris Santerre wrote:

> 
> 
> > -----Original Message-----
> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> > Sent: Monday, May 26, 2003 8:15 PM
> > To: [EMAIL PROTECTED]
> > Subject: [SAtalk] How detect messages like these?
> > 
> > 
> > Hi,
> > 
> > Lately I've been getting a lot of messages which have little
> > or no text
> > in them, they just have an image with the spam.
> > 
> > How can SA catch this sort of thing?
> > 
> > Thanks
> > Ricardo
> > 
> > ---------- Forwarded message ----------
> > From: Kristy <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Date: Mon, 26 May 2003 13:13:20 -0400
> > Subject: You get my message?
> > 
> > <html>
> > <body>
> > <br>
> > <center>
> > <img src="http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/i
> > mage.asp?cmp
> > id=vigrex-106.gif&dvn=25J82C6x1L_L85fwJ6L" width="0" height="0"> 
> > <br>
> > <a
> > href="http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/
> > ctrack.asp?c
> > mpid=vigrex-106&cvn=A[,dA9siFznzd[S0,sz">
> > <img
> > src="http://u4j6u80zbzid3d64zozaj0d.stop-and-shop.net/vigrex-106.gif";
> > border="0"></a>
> > <br>
> > <br>
> > <a
> > href="http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/
> > remove/remov
> > e.asp">
> > <img src="http://u4j6u80zbzid3d64zozaj0d.stop-and-shop.net/unsub.gif";
> > border="0"></a>
> > </center>
> > </body>
> > </html>
> > 
> 
> Several ways. All of these scored small, and let them add up.
> Search for:
> online.?shop 
> c?track.asp
> and my favorite.... letters that don't belong together in english:
> /z(j|b|x)/i     and so on........ One rule for each letter, like
> /j(z|x|b)/i
> .......
> 
> Also keep a rule for tagging your own known spammers. 
> /22its4you\.(net|com)/i
> 
> 
> 
> 
>  


-------------------------------------------------------
This SF.net email is sponsored by: ObjectStore.
If flattening out C++ or Java code to make your application fit in a
relational database is painful, don't do it! Check out ObjectStore.
Now part of Progress Software. http://www.objectstore.net/sourceforge
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to