RE: Hebrew Custom Rules and Israeli Evil Numbers/URIs

[Ilan Aisic]

Title: Message

Hi, I've started to write and maintain 2 rule files.  One with common Hebrew phrases that would be found in a spam (things that would translate to "Click below",  "No Commitment", etc.) and another one which is just a list of "Evil URIs" that I collected over time and placed in a blacklist.   Hebrew is tricky because there are few codesets and representations for it.  The 2 most common are using 8 bit characters where the first 7 bits are the kept for ASCII.  Directionality is also tricky.  So sometimes, you'd see a Hebrew web site or a Hebrew email in reverse and sometimes in gibberish.  In most cases if you change the browser or mail client encoding it would help but not always.    For example, IE supports the following 3 encoding for Hebrew: Hebrew (Windows) Hebrew (ISO-Visual) Hebrew (ISO-Logical)     I've recently changed my mail server from sendmail to exim with exiscan clamAV and SA.  Beging new to SA I assume that there must be some other Israelies who are using it and probably created rules for it.  The Linux community here is fairly large so I guess I probaby need to place my question on a local Linux mailing list.   The rule files I have are still in their infancy.  If I don't find someone who already has such rule files, I'll keep expanding and maintaing them.  Once I feel they're mature and tested I'll advertize them.   Regards,   -- Ilan Aisic    -----Original Message----- From: Loren Wilton [mailto:[EMAIL PROTECTED] Sent: Monday, March 01, 2004 2:21 AM To: [EMAIL PROTECTED] Subject: Re: Hebrew Custom Rules and Israeli Evil Numbers/URIs I don't know of one, but I'm relatively new around here, someone else might know of one.   At the risk of saying the obvious, such a thing would have to be built, or at least collected, by someone who:     a) understands Hebrew     b) gets Hebrew spams and can recognize them as such   Actually making BigEvil/EvilNumbers type rules are fairly simple and straight-forward, once one has a reliable source if input numbers and urls.   I suspect most of us on the list fail the two required tests for being able to build such a list, but could probably build the list given input from someone that can recognize such things.   My one concern is that there could possibly be something about Hebrew syntax that could complicate the regexp writing for such tests.  Since I don't know even the basic syntax of the language, I don't know if such possibilities would exist or not.  It might be better if someone who knew the language wrote the rules, to avoid what would be obvious pitfalls.           Loren ----- Original Message ----- From: Ilan Aisic To: [EMAIL PROTECTED] Sent: Sunday, February 29, 2004 6:14 AM Subject: Hebrew Custom Rules and Israeli Evil Numbers/URIs Has anyone ever create custom rules that would match Hebrew spam messages? How about Israeli "evil numbers and URIs" ?   Thanks in advance,   Ilan Aisic