Hi, On Fri, Jun 14, 2013 at 9:51 AM, John Hardin <jhar...@impsec.org> wrote: > On Thu, 13 Jun 2013, Alex wrote: > >> Hi, >> >> On Thu, Jun 13, 2013 at 9:55 PM, John Hardin <jhar...@impsec.org> wrote: >>> >>> On Thu, 13 Jun 2013, Amir 'CG' Caspi wrote: >>> >>>> Lately, I've been getting hit with a LOT of this type of spam: >>>> >>>> http://pastebin.com/HD0rNdxU >>> >>> >>> http://ruleqa.spamassassin.org/20130613-r1492572-n/STYLE_GIBBERISH/detail >> >> >> John, I've just tried with your latest, and his sample doesn't hit >> STYLE_GIBBERISH. Any suggestions? > > > Hmm. I created an HTML message with a series of words in the style tag and > it did hit. I'll try it on your sample directly. > > There are some FP-reduction exclusions, add a local rule like: > > meta STYLE_GIBBERISH_RAW __STYLE_GIBBERISH > score STYLE_GIBBERISH_RAW 0.0001 > > to see if the FP exclusions are keeping it from hitting for you.
It still doesn't hit. I'm also noticing a different form that appears to just include the gibberish in the body itself, not surrounded by style tags. It also confuses bayes and doesn't hit longwords either. http://pastebin.com/P3mQbwmH In the longrun, I'm not sure how effective this would be anyway. Other times they just use gibberish news feeds with actual punctuation, which would prevent these rules from firing anyway. I'm actually more interested in knowing why this didn't hit bayes99 when many others already do. Is the body gibberish enough to prevent it from being classified properly? Thanks, Alex
