On Wed, 13 Jan 2021, Philipp Ewald wrote:
Hello,
we try to deliver mails to GMX/WEB but we got frequency blocked because
"ro-reply@ Mails" hits following rules:
SUBJ_OBFU_PUNCT_FEW -> Possible punctuation-obfuscated Subject: header
SUBJ_OBFU_PUNCT_MANY -> Punctuation-obfuscated Subject: header
The scores on those rules are rather low - they are not "poison pills".
What *else* are those mails hitting?
An actual sample of a problematic subject text would be very helpful to
allow us to suggest how you could fix the problem or to add an exception
for the rule if it's a valid FP.
i can't find any good declaration for this rules.. can some one explain
please? (easy as possible)
Does that has todo with ".", ";", ":" in Headers?
Alex did a good job. Basically: multiple instances of letter-punct-letter
or punct-letter-punct in the message subject.
Spammers have used punctuation to obfuscate "trigger words" in subjects,
like:
:B:U:Y: :Y:O:U:R: :C:H:E:A:P: :V:I:A:G:R:A: :H:E:R:E: :T:O:D:A:Y:
in an attempt to bypass naïve text matching filters. These rules are
intended to detect that.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
How do you argue with people to whom math is an opinion? -- Unknown
-----------------------------------------------------------------------
4 days until Benjamin Franklin's 315th Birthday
