Topic: Getting rid of "Via gra" & "c alis",

[alejandro]

Does any body knows how to get this spam discarded by spamassasin
or assp? both are eluded.

Spammers have managed to bypass the filter 1) by mixing up letters with spaces and mixing alineation justification and orientation and  2) by poissoning bayesian database with pasted phrases from books and so.

any ideas?
tons of pills are bypasing my server's mail spam protection system

 I think when finally I'm able to get rid of this kind of mails I'll probably need what they advertice (just valium of course )

[CharlieBrady]

 I think when finally I'm able to get rid of this kind of mails ...

Don't expect that to happen any time soon. There is a constant evolutionary struggle between spammers and those who want to prevent spam. If we could give you a perfect solution today, it wouldn't necessarily succeed tomorrow.

[alejandro]

I agree with that...
But I'm trying (i'm not a developer at all) to stablish a rule to stop this mails.
my goal is to define what is a common logic to every "pill advertisement spam" and to translate in a rule for assp or spamassasin
I'm thinking in silabic/letter proximity in the expressions defined to identify spam but .... just draft work.
I'll try to write some "code" and see what happens (poor thing my server!)

regards

[CharlieBrady]

my goal is to define what is a common logic to every "pill advertisement spam" and to translate in a rule for assp or spamassasin
I'm thinking in silabic/letter proximity in the expressions defined to identify spam but .... just draft work.

SpamAssassin already has such rules. The mail which phpbb sent me to notify about a new message in this thread was tagged as spam:

 0.2 NO_REAL_NAME           From: does not include a real name
 1.8 SUBJECT_DRUG_GAP_VIA   Subject contains a gappy version of 'viagra'
 3.2 VIA_GAP_GRA            BODY: Attempts to disguise the word 'viagra'
 0.0 DRUGS_ERECTILE         Refers to an erectile drug
 0.8 DRUGS_ERECTILE_OBFU    Obfuscated reference to an erectile drug

I'm running spamassassin 3.0.2 without anything fancy in its config.

[alejandro]

Thanks Charlie, for the answer.
I'll switch back to spamassasin, and check if is missconfigured.
regards