ok,
this crap is everywhere now. here is my rule, for those that are
interested.
run against your recent corpus data, since you wont find much of
anything on data thats more than 1 month old.
curious, has anyone had many paris hilton false negatives???
# Tue Dec 2 11:48:24 CST 2003 -- be
> -Original Message-
> From: ian douglas [mailto:[EMAIL PROTECTED]
> Sent: Monday, November 24, 2003 6:46 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] paris hilton
>
>
> Anyone have any good obfuscation rules for p4r1s h1|+0n spam?
> I'm ge
Hi Ian
> -Original Message-
> From: [EMAIL PROTECTED]
[mailto:spamassassin-
> [EMAIL PROTECTED] On Behalf Of ian douglas
> Sent: Monday, November 24, 2003 8:42 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] paris hilton
>
> > Haven't seen the spam but
ian douglas said:
>> Haven't seen the spam but one of these should work if your
>> example text is always the same:
>
> No, it's different... started out being non-obfuscated, but has gradually
> gotten more and more "l337".
>
> -id
Try this:
http://sandgnat.com/cmos/temp/paris_hilton.cf
Generat
ian douglas said:
>> Anyone have any good obfuscation rules for p4r1s h1|+0n spam? I'm
>> getting a ton of these every day...
>
> http://sandgnat.com/cmos/cmos.jsp gave me a good result, but will not
> match
> a plus sign to substitue for a 't' character.
>
> -id
Good suggestion, Ian. That replac
Here is a net block of a spammer in training
and had the misfortune (on our network at least)
to hit one of our control addresses (repeatedly)
inetnum: 203.192.162.192 - 203.192.162.255
netname: HAN-SERVER-KR-NETBLK1
country: KR
descr:Hanserver.Net
The following is the text
> Haven't seen the spam but one of these should work if your
> example text is always the same:
No, it's different... started out being non-obfuscated, but has gradually gotten more
and more "l337".
-id
---
This SF.net email is sponsored b
YM_B_OBFU_PARIS Subject contains "p4r1s"
score YM_B_OBFU_PARIS 10.0
-matt
-Original Message-
From: [EMAIL PROTECTED] on behalf of ian douglas
Sent: Mon 11/24/2003 5:46 PM
To: [EMAIL PROTECTED]
Cc:
Subje
> Anyone have any good obfuscation rules for p4r1s h1|+0n spam? I'm
> getting a ton of these every day...
http://sandgnat.com/cmos/cmos.jsp gave me a good result, but will not match
a plus sign to substitue for a 't' character.
-id
---
This
Anyone have any good obfuscation rules for p4r1s h1|+0n spam? I'm getting a
ton of these every day...
-id
---
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you crea
10 matches
Mail list logo
