<br><font size=2 face="sans-serif">Hi,</font>
<br>
<br><font size=2 face="sans-serif">Thanks to all who helped me with the
obfuscated spam words - implementing my own rules now</font>
<br><font size=2 face="sans-serif">works like a charm.</font>
<br>
<br><font size=2 face="sans-serif">Kind regards,<br>
<br>
David Jacobson<br>
Network Security Administrator<br>
RHCE<br>
<br>
Imperial Online - The Imperial Connection<br>
<br>
Switchboard (+27) 11 723-8000<br>
Helpdesk (+27) 11 723-8181<br>
Mobile (+27) 83 235-0760<br>
Facsimile (+27) 11 454 1236 <br>
Email davidj@impol.net<br>
<br>
www.imperialonline.co.za / www.imperialtoday.co.za<br>
<br>
Confidentiality Notice:<br>
This communication and the information it contains are intended for the
person(s) or organisation(s) named above and for no other person(s) or
organisation(s). <br>
The content of this communication may be confidential, legally privileged
and protected. Unauthorised use, copying or disclosure of any part of this
communication may be unlawful.</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM></b>
</font>
<br><font size=1 face="sans-serif">Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK></font>
<p><font size=1 face="sans-serif">02/20/2004 11:57 AM</font>
<table border>
<tr valign=top>
<td bgcolor=white>
<div align=center><font size=1 face="sans-serif">Please respond to<br>
MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK></font></div></table>
<br>
<td width=59%>
<table width=100%>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td valign=top><font size=1 face="sans-serif">MAILSCANNER@JISCMAIL.AC.UK</font>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td valign=top>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td valign=top><font size=1 face="sans-serif">Re: Wierd words for spam
filter</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=2><tt>david<br>
<br>
try the antidrug ruleset at<br>
http://mywebpages.comcast.net/mkettler/sa/antidrug.cf<br>
<br>
having said that I'm running it and it didn't trigger it, but this rule<br>
did...<br>
<br>
# Created using Chris's Mediocre Obfuscation Script Version 0.00.0.0001h<br>
# http://sandgnat.com/cmos/<br>
#<br>
<br>
header LOCAL_OBFU_VGR_SUBJ Subject =~<br>
/(?:\b[vu]|\B(?:\\\/|\xCE\xBD))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g6]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4]\b|(?:[\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\!
x<br>
B1|\xD0\x90|\xD0\xB0)\B)/i<br>
score LOCAL_OBFU_VGR_SUBJ 2.6<br>
describe LOCAL_OBFU_VGR_SUBJ Obfuscated 'viagra' in subject<br>
<br>
body LOCAL_OBFU_VGR<br>
/(?:\b[vu]|\B(?:\\\/|\xCE\xBD))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g6]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4]\b|(?:[\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\!
x<br>
B1|\xD0\x90|\xD0\xB0)\B)/i<br>
score LOCAL_OBFU_VGR 1.8<br>
describe LOCAL_OBFU_VGR Obfuscated 'viagra' in body<br>
xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4]\b|(?:[\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)\B)/i<br>
score LOCAL_OBFU_VGR_SUBJ 2.6<br>
describe LOCAL_OBFU_VGR_SUBJ Obfuscated 'viagra' in subject<br>
<br>
<br>
body LOCAL_OBFU_VGR<br>
/(?:\b[vu]|\B(?:\\\/|\xCE\xBD))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g6]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4]\b|(?:[\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\!
x<br>
B1|\xD0\x90|\xD0\xB0)\B)/i<br>
score LOCAL_OBFU_VGR 1.8<br>
describe LOCAL_OBFU_VGR Obfuscated 'viagra' in body<br>
<br>
If you also add in the xanax and others as well (generated using Chris's<br>
CGI scripts on his home page above) you should be able to trigger
a<br>
spam action.<br>
<br>
--<br>
Martin Hepworth<br>
Snr Systems Administrator<br>
Solid State Logic<br>
Tel: +44 (0)1865 842300<br>
<br>
<br>
David Jacobson wrote:<br>
><br>
> Hi Again,<br>
><br>
> I've got customers complaining that spam is coming through and when<br>
> analyzing the e-mails<br>
> I notice they're using words as follows:<br>
><br>
> <<FWD: Need Meds Valiu+m+ $ v|agr@ % Xan_a_x _ At`|v@n
' Pnte.r.min - =<br>
> Som+a+ gJe3w>> <<FWD: On sale V1Agr@ ; xan@x
' V.a.lium & At|v:@n * =<br>
> +Soma+ < Pn.t.ermin fmRdI>> <<FWD: Everything
4 U /Xanax/ ' :V:alium # =<br>
> v|@gRa ) A:t|v@n + .S.oma _ Pnter:m:in Q6bgh>> <<Re:
flanders>> =<br>
> <<Re:>>=20<br>
><br>
> which are not getting tagged, now everytime I try add special words
like<br>
> that with pipes colons pluses etc<br>
> it seems to break stuff and tag everything as spam, can someone give
me<br>
> an example of how to add such<br>
> words?<br>
><br>
> Thanks<br>
><br>
> Kind regards,<br>
><br>
> David Jacobson<br>
> Network Security Administrator<br>
> RHCE<br>
><br>
> Imperial Online - The Imperial Connection<br>
><br>
> Switchboard (+27) 11 723-8000<br>
> Helpdesk (+27) 11 723-8181<br>
> Mobile (+27) 83 235-0760<br>
> Facsimile (+27) 11 454 1236<br>
> Email davidj@impol.net<br>
><br>
> www.imperialonline.co.za / www.imperialtoday.co.za<br>
><br>
> Confidentiality Notice:<br>
> This communication and the information it contains are intended for
the<br>
> person(s) or organisation(s) named above and for no other person(s)
or<br>
> organisation(s).<br>
> The content of this communication may be confidential, legally<br>
> privileged and protected. Unauthorised use, copying or disclosure
of any<br>
> part of this communication may be unlawful.<br>
<br>
**********************************************************************<br>
<br>
This email and any files transmitted with it are confidential and<br>
intended solely for the use of the individual or entity to whom they<br>
are addressed. If you have received this email in error please notify<br>
the system manager.<br>
<br>
This footnote confirms that this email message has been swept<br>
for the presence of computer viruses and is believed to be clean.<br>
<br>
**********************************************************************<br>
</tt></font>
<br>