[Mimedefang] got my mojo working

[Dave Helton]

On Mon, 2004-02-23 at 14:18, Brent J. Nordquist wrote:
> Some more thoughts:
> 
> On Mon, 23 Feb 2004, Dave Helton <dave at kd0yu.com> wrote:
> 
> >         if ($line =~ /[Mm][Ee][Dd][Ss]/) {$subscore += 6};
> >         if ($line =~ /[Pp][Ii][Ll][Ll][Ss]/) {$subscore += 6};
> >         $line =~ s/@/a/g; 
> >         $line =~ s/1/i/g;
> 
> Also 6 for g, | and ! for i, and all the same characters for l as for i.  
> Those are what I've seen here.  Why are you doing the substitution after
> the checks for "meds" and "pills" (won't find p1lls for example)?

rarely have I seen meds or pills obfuscated although I'm sure there are
cases... in this bit of code it worked for me.  to be honest... the
rules that governed this script were based on a few spam sources that
seemed to plague me with the same type of emails over and over.
 
> 
> You might think about accented versions of the vowels which I'm starting 
> to see also.
> 
> Other words to consider flagging:  "pharmacy" "drugs"
> 
> >         if ($line =~ /[Vv][Ii][Aa][Gg][Rr][Aa]/) {$subscore += 3};
> 
> Couldn't you use /viagra/i (simpler) once you're to this point?

because I'm not that familiar with perl, but I will be updating the
script to reflect your suggestion.  It's certainly much easier to read.

> And then there are all the misspellings that are really common.  Here's 
> just the latest few from my corpus:  "v?agra" "viegra" "VUiagra" (or any 
> other extra letter thrown in) "viagrga" "vaiagra"  Once I saw "\/iagra".
> 

seen that one today too.  **brain started to hurt**

> And a whole bunch of misspellings like "viaggra" listed in antidrug.cf
> mentioned here earlier today.  Discouraged yet?  :-)

no.. thats why I'm not unsubscribing the list either ;)
the fight never ceases, always new weapons and tactics, and it keeps me
on my toes ;)


-- 
Dave Helton, KD0YU <dave at kd0yu.com>
Real World Computing, network consultant.
Davenport, IA, US
563-386-4041
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <https://lists.mimedefang.org/pipermail/mimedefang_lists.mimedefang.org/attachments/20040223/fc21c8de/attachment-0001.sig>