[Mimedefang] Tiny Text
Martin Blapp
mb at imp.ch
Tue May 10 12:31:03 EDT 2005
Hi,
> our Bayes data! It seems that the ASCII artists don't
> always change the strings they use for their "art", so things
> like "rvwndsho" and "xpoebbcr" started to become statistically
> significant in our Bayes data.
We use a specific ruleset against those 'ASCII artists', the
rawbody __SMALL_FONT /font-size:[\s\t ]{1,3}(?:1|2)(?:px|pt|;)/i
rule is part of them. We also look for different gaps between chars
rawbody __GAP_2_CHAR /[a-z][ ]{5}[a-z]/i
rawbody __GAP_3_CHAR /[a-z][ ]{6}[a-z]/i
rawbody __GAP_4_CHAR /[a-z][ ]{7}[a-z]/i
rawbody __GAP_5_CHAR /[a-z][ ]{8}[a-z]/i
rawbody __GAP_6_CHAR /[a-z][ ]{9}[a-z]/i
rawbody __GAP_7_CHAR /[a-z][ ]{10}[a-z]/i
rawbody __GAP_8_CHAR /[a-z][ ]{11}[a-z]/i
rawbody __GAP_9_CHAR /[a-z][ ]{12}[a-z]/i
rawbody __GAP_10_CHAR /[a-z][ ]{13}[a-z]/i
But just using this rules would produce too many false positives, so we
have developed our own ruleset (and I have tried to avoid false positives,
but I am still very happy to get bugfixes)
http://antispam.imp.ch/rules/asciispam.cf
Maybe it is useful for you.
Martin
More information about the MIMEDefang
mailing list