[Mimedefang] New way of obfuscating text

[Michael Sims]

mimedefang-bounces at lists.roaringpenguin.com wrote:
> On Tue, 10 Feb 2004, Michael Sims wrote:
>> Here's the pattern I finally settled on:
>>
>> /font-size:\s*1\s*(?:p[xt])?\s*;/i
>
>    Cool, I think I will go with that one too.  Just out of curiosity,
> how are you scoring that, and what is your "reject" threshold (if
> any)?

Right now I set the score to 0.1 just to see what kind of stuff it caught.
So far I have 31 messages, all have been junk.  I'm going to check it again
in the morning and if there's nothing but junk in there, I'll probably score
it at 4.  5.0 is the threshold I'm using site-wide to move mail into a "Junk
Mail" folder (I reject during the SMTP conversation if the score is 15 or
up).  Most of the annoying spam that slips through SpamAssassin tends to
score around 1-2, so I tend to stick with 4 on rules that are usually spam
indicators.  I also don't like having any one SA rule that can push a
message above the threshold by itself.  If I did that then many of the
messages on this list where the text is mentioned would be flagged
incorrectly as spam...

___________________________________________
Michael Sims
Project Analyst - Information Technology
Crye-Leike Realtors
Office: (901)758-5648  Pager: (901)769-3722
___________________________________________