Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: alejandro on January 02, 2006, 04:10:45 PM

Title: Getting rid of "Via gra" & "c alis",
Post by: alejandro on January 02, 2006, 04:10:45 PM

Does any body knows how to get this spam discarded by spamassasin
or assp? both are eluded.

Spammers have managed to bypass the filter 1) by mixing up letters with spaces and mixing alineation justification and orientation and  2) by poissoning bayesian database with pasted phrases from books and so.

any ideas?
tons of pills are bypasing my server's mail spam protection system

 I think when finally I'm able to get rid of this kind of mails I'll probably need what they advertice (just valium of course ;-))

Title: Re: Getting rid of "Via gra" & "c alis&qu
Post by: CharlieBrady on January 02, 2006, 04:59:01 PM

Quote from: "alejandro"

 I think when finally I'm able to get rid of this kind of mails ...

Don't expect that to happen any time soon. There is a constant evolutionary struggle between spammers and those who want to prevent spam. If we could give you a perfect solution today, it wouldn't necessarily succeed tomorrow.

Title: Getting rid of "Via gra" & "c alis",
Post by: alejandro on January 03, 2006, 04:17:37 PM

I agree with that...
But I'm trying (i'm not a developer at all) to stablish a rule to stop this mails.
my goal is to define what is a common logic to every "pill advertisement spam" and to translate in a rule for assp or spamassasin
I'm thinking in silabic/letter proximity in the expressions defined to identify spam but .... just draft work.
I'll try to write some "code" and see what happens (poor thing my server!)

regards

Title: Getting rid of "Via gra" & "c alis",
Post by: CharlieBrady on January 03, 2006, 04:28:29 PM

Quote from: "alejandro"

my goal is to define what is a common logic to every "pill advertisement spam" and to translate in a rule for assp or spamassasin
I'm thinking in silabic/letter proximity in the expressions defined to identify spam but .... just draft work.

SpamAssassin already has such rules. The mail which phpbb sent me to notify about a new message in this thread was tagged as spam:

 0.2 NO_REAL_NAME           From: does not include a real name
 1.8 SUBJECT_DRUG_GAP_VIA   Subject contains a gappy version of 'viagra'
 3.2 VIA_GAP_GRA            BODY: Attempts to disguise the word 'viagra'
 0.0 DRUGS_ERECTILE         Refers to an erectile drug
 0.8 DRUGS_ERECTILE_OBFU    Obfuscated reference to an erectile drug

I'm running spamassassin 3.0.2 without anything fancy in its config.

Title: Getting rid of "Via gra" & "c alis",
Post by: alejandro on January 03, 2006, 04:42:56 PM

Thanks Charlie, for the answer.
I'll switch back to spamassasin, and check if is missconfigured.
regards