Bayes problem and smart spammers

Carl Boberg Carl.Boberg at NRM.SE
Thu Oct 30 15:42:21 GMT 2003


Hi,
Im starting to get quite a few false positives, manily due to the bayes enngine.

Looks like this:

> X-Mailscanner-Spamcheck: not spam, SpamAssassin (score=-0.156, 
> required 5, BANG_MORE 1.16, BAYES_00 -4.90, HTML_FONTCOLOR_RED 0.10, 
> HTML_FONTCOLOR_UNKNOWN 0.10, HTML_FONT_BIG 0.27, HTML_MESSAGE 0.10, 
> MIME_HTML_ONLY 0.32, NORMAL_HTTP_TO_IP 0.10, RCVD_IN_DYNABLOCK 2.60, 
> UPPERCASE_25_50 0.00)

As you can see bayes has scored this email with -4.90 fo some reason.
The content looks like this:

> S.URPRISE YOUR L.OVER TODAY! COVER HER WHOLE FACE WITH C.UM!
>
> How w.ould you like to
> SHOOT LIKE THE PO.RN-STARS?
> Up to 500% more S.PERM!
>
> *     ADD UP_TO 500% MORE SPER.M
> *     MALE MULTIPLE ORGAS.MS
> *     HAVE M.ORE INTENSE 0.RGASMS
> *     PRODUCE ST.RONGER E.RECTIONS
> *     HAVE A STRONGER 5.EXUAL DESIRE
> *     1.NCREASED S.E..XUAL STAMINA
>
> FULLY DO.CTOR APP.ROVED! L.EARN MORE!
>
> WE NEVER LEAVE A CUSTOMER UNSATISFIED! 100% MONE.Y BACK GUARAN.TEE!
>
> qpi203r4932o5sa9r4j2n4589v7p6t00542uoy51260495l032v5475f36d116
> ml88v6z0813917i83le0677b1rw94b2gy3fe8900156j4cth6x1192b3256k41
>
> 520yqpi203r4932o5sa9r4j2n4589v7
> My dog is very promiscuous.
>
> I abruptly slapped Katie for no good reason.
> p6t00542uoy51260495l032v5475f36d1g5mk87v6z0813817h83ld0677a1qw94b2gx3e
> d
> 8900146j4cth6x1192b325
> 6k40520xqpi203r4931n5sa9r4j2n35
>
> To stop from getting these, Here
> My dog is very promiscuous.My dog is very promiscuous.I abruptly 
> slapped Katie for no good reason.My dog is very promiscuous.

As tou can see they are using dots in the middle of dangerous words and also seem to put in random ascii text.

Is it possible to throw a bunch of theese kinds of mail to a spam learn box for bayes? How many will it take to generate effect?
Is there some other way around this sort of spam?

Best regards
--------------------------------
Carl Boberg
System & Network Administrator
Swedish Museum of Naturalhistory
Frescativägen 40
104 05 Stockholm
Sweden
Tel nr: 08-5195 5116
Mobile: 0701-82 4055 
E-mail: carl.boberg at nrm.se
--------------------------------




More information about the MailScanner mailing list