Clever Spammers, Anything to catch this?

[Rick Cooper]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]



> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Glenn Steen
> Sent: Monday, November 21, 2005 3:59 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Clever Spammers, Anything to catch this?
>
>
> On 20/11/05, Rick Cooper <rcooper at dwford.com> wrote:
> (snip)
> > I attached a copy of the changes I made to Matt's rules and it
> also includes
> > my own rule. My own rule doesn't care about the words just the
> methodology
> > used. I didn't get any FPs with the latest SA public Corpus BTW.
> >
> Thanks, will drop them into place and see what happens... (If they
> work out well, at least my PHB will be ecstatic... Probably me too:-).
>

Try the attached. It matches on a grid bounded by DIV tags so something
like:

abcde
fghij
klmno
pqrst
uvwxy

would require 's' to exist. but it would also catch A<br>ra<br> (I have
gotten one like that) I ran against the full public SA corpus and the
messages I had already captured. Caught all of my captured messages, no FPs.
the freqs report is in the header of the attachment.

Rick

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/OCTET-STREAM (Name: "RcDIVObs.cf")  2.1KB. ]
    [ Unable to print this part. ]