[sclug] Any thoughts on how to block these? (long-ish)

[Simon Huggins]

On Mon, Jan 12, 2004 at 09:11:56AM +0000, Patrick Kirk wrote:
> I hope this plea for help gets past people's spam filters!

> My spam filters are being beaten by up to 20 of these emails a day. 
> They all have the following characteristics.
> 1. Random words in the subject line, usually lower case
> 2. Lots of random words in the body in a seperate block from the 'pitch'
> 3. Words like 'click' are obfusticated
> 4. The X-Mailer header is a set of random words

> I would guess that the randomness is a way of beating Bayesian filters. 
> My only thought so far has been to exclude all email not from a list 
> of known mail agents but that's cumbersome.

> Has anyone else this problem and have you found a way of blocking these?

Your mail ended up in spam-unsure for me so maybe your filter just needs
more training?

Random words aren't as much of a problem as people make out unless you
receive lots of them in your ham as well.

Please forward gzip'd as an attachment or something if you want me to
see messages with spam attached in future.

For instance: (spaces added to protect the filters :))
                            n  pgood     pbad      fw
	"s i a m e s e"    10  0.000019  0.000144  0.885933 +
	"c o l l o q"       7  0.000000  0.000126  0.999916 +
	"b o s o n i c"    10  0.000000  0.000180  0.999942 +

I haven't bothered to search for the rest but they're all good
indicators of spam to my copy of bogofilter at least.

As long as you train on them I think you'll be fine.

-- 
 ,--huggie-at-earth-dot-li--------stuff-thing-stuff----------DF5CE2B4--.
_| "How should I know if it works? That's what beta testers are for.  |_
 |                 I only coded it" - Linus Torvalds                  |
 `- http://www.earth.li/~huggie/ - http://www.blackcatnetworks.co.uk/ -'