>whine>
I feel so *ignored*.....
I posted the 'snapshut' rule and the logo obfuscation rule already.
No one listens to me.
>/whine>
:-)
- Charles
On Mon, 23 Feb 2004, Loren Wilton wrote:
> Date: Mon, 23 Feb 2004 16:23:29 -0800
> From: Loren Wilton <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Subject: [spa] Re: Logo spams
>
> Taking a quick look at the first one (and I wish you would post as text
> rather than html next time!) I see some interesting things that will
> probably hold for some time:
>
> 1. www.snapshut.info should be added to the BigEvil list
>
> 2. The word "logo" or "Logo" appears 8 times in the body of the message.
> Suspicious.
>
> 3. The word "Iogo" (capital I, not L) appears twice, intended to be
> obfuscation.
>
> 4. The word "Ioqo" (capital I, q instead of g) appears once as
> obfuscation.
>
> 5. The word 'quality' is spelled "guaIity", again intended as
> obfuscation.
>
> Taken together, these can make some fairly nice rules specific to this spam.
>
> body __LOGOS /(?:\blogo[s]?\b){6,99}/i
> body __BAD_LOGOS /\bIo[gq]o[s]?\b/
> body __POOR_QUALITY /gua[lI]ity/
>
> meta NASTY_LOGOS (__LOGOS && (__BAD_LOGOS || __POOR_QUALITY))
> score NASTY_LOGOS 5.0
>
> uri SNAPSHUT /www\.snapshut\.info/
> score SNAPSHUT 2.0
>
> Loren
>
