Emails made up of random words

[Nathan Johanson]

Which ruleset (popcorn, weeds, etc.) appears to do the best job against these kinds of spam (based on your experience so far)?
-Nathan

	-----Original Message----- 
	From: Rick Cooper [mailto:rcooper at DIMENSION-FLM.COM] 
	Sent: Fri 1/9/2004 3:32 AM 
	To: MAILSCANNER at JISCMAIL.AC.UK 
	Cc: 
	Subject: Re: Emails made up of random words
	
	

	> -----Original Message-----
	> From: MailScanner mailing list
	> [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
	> Behalf Of Howard Robinson
	> Sent: Friday, January 09, 2004 4:33 AM
	> To: MAILSCANNER at JISCMAIL.AC.UK
	> Subject: Emails made up of random words
	>
	>
	> Dear List members,
	> We are getting increasing numbers of emails containing
	> what look
	> like a selection of random words. It only started here before
	> Christmas. Is this a new phenomenon or have we just been lucky
	> before?
	> Whilst they are still manageable numbers at the moments & can
	> be quickly deleted there one or two members of staff
	> are getting
	> their knickers in a twist about them.
	> What's the best way to deal with them (the emails not
	> the staff)?
	>
	> Thanks and happy new year to you all.
	>
	>
	>
	> Regards
	>
	> Howard Robinson
	
	Go here http://www.emtinc.net/spamhammers.htm and use these rules
	if you are not already.
	There is much discussion of this topic (bayes poison) on the
	spamassassin list and there are a couple of counter measures
	being developed so you may want to subscribe to spamassassin-talk
	and follow the thread relating to large collections of random
	words.
	
	This rule has caught a few for me (they are hiding the words with
	0pt font)
	
	rawbody LOCAL_ZERO_FONTSIZE /\bfont-size\:
	0pt|font.*size="0"|font.*size=0/i
	describe LOCAL_ZERO_FONTSIZE Font has a size of Zero. What is
	being hidden?
	score LOCAL_ZERO_FONTSIZE 4.5
	
	as has this one
	
	uri BAYES_BUSTER
	/rx359|2004hosting|530000X|openseed|er5hdh|quickforms/i
	describe BAYES_BUSTER Trying to bypass BAYES
	score BAYES_BUSTER 10.0
	
	Best thing, follow the sa-talk list
	
	Rick
	
	
	--
	This message has been scanned for viruses and
	dangerous content by MailScanner, and is
	believed to be clean.