Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - B:E:S:T   T:R:A:N:N:Y   P:0:R:N:0   H:E:R:E !!
  FAQ FAQ  Forum Search   Register Register  Login Login

B:E:S:T T:R:A:N:N:Y P:0:R:N:0 H:E:R:E !!

 Post Reply Post Reply
Author
MarvinFS View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote MarvinFS Quote  Post ReplyReply Direct Link To This Post Topic: B:E:S:T T:R:A:N:N:Y P:0:R:N:0 H:E:R:E !!
    Posted: 21 April 2003 at 6:12am

Want to filter such form of spam's subject

B:E:S:T   T:R:A:N:N:Y   P:0:R:N:0   H:E:R:E !!

or

B.E.S.T   T.R.A.N.N.Y   P.0.R.N.0   H.E.R.E !!

should i make a blacklist entry like that?

B,E,S,T,T,R,A,N,N,Y

or may be only one "T" letter there above?

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 21 April 2003 at 5:05pm

Unfortunately that won't work. We have not documented this yet, but the keywords need to be at least 2 characters long. We did so to avoid triggering rejections in case users had a single letter in that list.

Your solution would not be a good idea either, since the content filter would look in the whole message for those letters, not just at a single line of text, so it would be fairly easy to reject legitimate emails. This posting for example would be rejected since it does contain all of those letters.

Roberto F.
LogSat Software

Back to Top
MarvinFS View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote MarvinFS Quote  Post ReplyReply Direct Link To This Post Posted: 22 April 2003 at 12:30am
So, is there a way to block such formed letters? it contains only subject and some picture attached... nothing special in header... what to do?
Back to Top
JimMeredith View Drop Down
Newbie
Newbie


Joined: 27 January 2005
Location: United States
Status: Offline
Points: 28
Post Options Post Options   Thanks (0) Thanks(0)   Quote JimMeredith Quote  Post ReplyReply Direct Link To This Post Posted: 25 April 2003 at 1:29am

To throw an idea into this discussion...

I've always thought that some sort of character filtering capability would be useful here.  Something that would allow rules-based replacement of certain characters -- ONLY in a cached COPY of the message used for testing, not in the actual message itself -- prior to keyword filtering.  In other words, the following filters could be set-up...

  • Replace "0" (the number zero) with "o" (the letter O).
  • Replace "#" with "h"
  • Replace "!" with "i" (the letter I)
  • Replace all other punctuation symbols with "" (nothing).

... and any other such rules that prove to be effective.  Please pardon the language here (this is a "clinical" discussion, not an attempt to offend; besides, if you deal with spam filtering, you see this and worse every single day)... just by using this limited set of rules, the following subject line:

Subj: SH!T, THAT B-I-T-C-# IS A W#0RE

... would be cleaned-up in the testing copy of the message... the exclamation point would be replaced with i, the #'s would be replaced with h's, the number zero would be replaced with letter o, and all other punctuation would be deleted, resulting in a subject line:

Subj: SHiT THAT BITCh IS A WhoRE

... which would then be able to trigger a case-insensitive keyword filter, if so desired.

This would filter SOME spam, but would still not do anything for those who insert space characters in hot keywords, i.e. "wh or e".  Filtering out the spaces and looking for embedded keywords just wouldn't work... "who referred you" becomes "whoreferredyou" which contains "whore", an instant false positive if you're filtering on that word.

Roberto, I think this probably goes well above and beyond your intent for SpamFilter in the here-and-now.  Just something to think about a few months from now, when you've finished the database logging functionality and everything else you're currently working on, and you're sitting around the office with nothing to do saying "what else could we do to enhance SpamFilter?" <grin>

Jim

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 25 April 2003 at 4:08pm

Hi Jim,

Actually your suggestions are extremely easy to implement. We have already designed SpamFilter to do keyword matches on a COPY of the original message, since we already do massage it a bit prior to the matching. Adding the subsitutions you refer to is not hard at all, even making them user-selectable can be done rahter quickly.

On our end, just by looking at our own personal experience with what spam makes it thru SpamFilter, we don't see a lot of messages like the above that skip thru. But if we get a few more "yes, we'd really like that feature" requests here we may be able to add that in before we have a chance to sit down, relaxing, rolling our thumbs...

Roberto F.
LogSat Software

Back to Top
MarvinFS View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote MarvinFS Quote  Post ReplyReply Direct Link To This Post Posted: 28 April 2003 at 12:08pm

Don't forget about other languages, like cyrillic etc, there are NO latin letters are in use or may be chinees language... so this substitution is only needed to latin based languages. btw some spammers are using this tech even in russina spam. like they substitute russian letter ("i") with latin one...  it looks like shit, but they are doing it... :)

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.078 seconds.