Clever Spammers, Anything to catch this?

Rick Cooper rcooper at DWFORD.COM
Mon Nov 21 17:23:39 GMT 2005

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Glenn Steen
> Sent: Monday, November 21, 2005 3:59 AM
> Subject: Re: Clever Spammers, Anything to catch this?
> On 20/11/05, Rick Cooper <rcooper at> wrote:
> (snip)
> > I attached a copy of the changes I made to Matt's rules and it
> also includes
> > my own rule. My own rule doesn't care about the words just the
> methodology
> > used. I didn't get any FPs with the latest SA public Corpus BTW.
> >
> Thanks, will drop them into place and see what happens... (If they
> work out well, at least my PHB will be ecstatic... Probably me too:-).

Try the attached. It matches on a grid bounded by DIV tags so something


would require 's' to exist. but it would also catch A<br>ra<br> (I have
gotten one like that) I ran against the full public SA corpus and the
messages I had already captured. Caught all of my captured messages, no FPs.
the freqs report is in the header of the attachment.


This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki ( and
the archives (

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/OCTET-STREAM (Name: "")  2.1KB. ]
    [ Unable to print this part. ]

More information about the MailScanner mailing list