RE: [SAtalk] How detect messages like these?

Tue, 27 May 2003 12:58:09 -0700 

Hence why I said "english lanquage" :-) 

This rule was designed for our company, which doesn't speak a word of
polish. I wouldn't recommend it for an ISP. But for small companies it
should work great. I also score each low, so a single false hit won't hurt
bad. 

I've been looking at the 3 letter scans. tooo many combos. Although maybe
polish has a frequent combo to be avoided (ie: zje or jze) 

> -----Original Message-----
> From: DEFFONTAINES Vincent [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, May 27, 2003 11:26 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] How detect messages like these?
> 
> 
> Strange enough, but there are many languages in the world 
> that don't look
> like english,
> and people use them every day to send ham to each other...
> 
> I believe rules like :
> 
> /z(j|b|x)/i
> /j(z|x|b)/i
> 
> match many polish words. 
> 
> Not that I know much about that language, but :
> 
> grep zb /usr/share/dict/polish|wc -l -> 17249
> zj -> 6649
> zx -> 0 (hehe)
> jz -> 813
> jx -> 0
> jb -> 597
> 
> 
> And not talking about all languages I do not have a single 
> clue about, 
> and may use those occurences in everyday talks.
> 
> So I don't think those two letters combinations are a very good idea.
> I would suggest matching more than 2 letters at a time, and 
> even then, 
> checking combinations against "plenty of" dictionnaries would seem a 
> prerequiste to me.
> 
> 
> My 2 cents,
> 
> Vincent
> 
> 
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
> Sent: Tuesday, May 27, 2003 4:16 PM
> To: [EMAIL PROTECTED]
> Cc: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] How detect messages like these?
> 
> 
> 
> Thanks for the reply.
> 
> Any chance SA could include these sorts of rules (especially 
> the one about
> letters that don't belong together in english) as part of the 
> default set of
> rules?
> 
> I don't really know how to setup my own rules, how would I do what you
> described below?
> 
> Thanks
> Ricardo
> 
> On Tue, 27 May 2003 10:09:24 -0400 Chris Santerre wrote:
> 
> > 
> > 
> > > -----Original Message-----
> > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> > > Sent: Monday, May 26, 2003 8:15 PM
> > > To: [EMAIL PROTECTED]
> > > Subject: [SAtalk] How detect messages like these?
> > > 
> > > 
> > > Hi,
> > > 
> > > Lately I've been getting a lot of messages which have little
> > > or no text
> > > in them, they just have an image with the spam.
> > > 
> > > How can SA catch this sort of thing?
> > > 
> > > Thanks
> > > Ricardo
> > > 
> > > ---------- Forwarded message ----------
> > > From: Kristy <[EMAIL PROTECTED]>
> > > To: <[EMAIL PROTECTED]>
> > > Date: Mon, 26 May 2003 13:13:20 -0400
> > > Subject: You get my message?
> > > 
> > > <html>
> > > <body>
> > > <br>
> > > <center>
> > > <img 
> src="http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/i
> > > mage.asp?cmp
> > > id=vigrex-106.gif&dvn=25J82C6x1L_L85fwJ6L" width="0" height="0"> 
> > > <br>
> > > <a
> > > href="http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/
> > > ctrack.asp?c
> > > mpid=vigrex-106&cvn=A[,dA9siFznzd[S0,sz">
> > > <img
> > > 
> src="http://u4j6u80zbzid3d64zozaj0d.stop-and-shop.net/vigrex-106.gif";
> > > border="0"></a>
> > > <br>
> > > <br>
> > > <a
> > > href="http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/
> > > remove/remov
> > > e.asp">
> > > <img 
> src="http://u4j6u80zbzid3d64zozaj0d.stop-and-shop.net/unsub.gif";
> > > border="0"></a>
> > > </center>
> > > </body>
> > > </html>
> > > 
> > 
> > Several ways. All of these scored small, and let them add up.
> > Search for:
> > online.?shop 
> > c?track.asp
> > and my favorite.... letters that don't belong together in english:
> > /z(j|b|x)/i     and so on........ One rule for each letter, like
> > /j(z|x|b)/i
> > .......
> > 
> > Also keep a rule for tagging your own known spammers. 
> > /22its4you\.(net|com)/i
> > 
> > 
> > 
> > 
> >  
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: ObjectStore.
> If flattening out C++ or Java code to make your application fit in a
> relational database is painful, don't do it! Check out ObjectStore.
> Now part of Progress Software. http://www.objectstore.net/sourceforge
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
> 


-------------------------------------------------------
This SF.net email is sponsored by: ObjectStore.
If flattening out C++ or Java code to make your application fit in a
relational database is painful, don't do it! Check out ObjectStore.
Now part of Progress Software. http://www.objectstore.net/sourceforge
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to