[Mimedefang] Tiny Text

[Martin Blapp]

Hi,

> our Bayes data!  It seems that the ASCII artists don't
> always change the strings they use for their "art", so things
> like "rvwndsho" and "xpoebbcr" started to become statistically
> significant in our Bayes data.

We use a specific ruleset against those 'ASCII artists', the

rawbody		__SMALL_FONT	/font-size:[\s\t ]{1,3}(?:1|2)(?:px|pt|;)/i

rule is part of them. We also look for different gaps between chars

rawbody		__GAP_2_CHAR	/[a-z][ ]{5}[a-z]/i
rawbody		__GAP_3_CHAR	/[a-z][ ]{6}[a-z]/i
rawbody		__GAP_4_CHAR	/[a-z][ ]{7}[a-z]/i
rawbody		__GAP_5_CHAR	/[a-z][ ]{8}[a-z]/i
rawbody		__GAP_6_CHAR	/[a-z][ ]{9}[a-z]/i
rawbody		__GAP_7_CHAR	/[a-z][ ]{10}[a-z]/i
rawbody		__GAP_8_CHAR	/[a-z][ ]{11}[a-z]/i
rawbody		__GAP_9_CHAR	/[a-z][ ]{12}[a-z]/i
rawbody		__GAP_10_CHAR	/[a-z][ ]{13}[a-z]/i

But just using this rules would produce too many false positives, so we
have developed our own ruleset (and I have tried to avoid false positives,
but I am still very happy to get bugfixes)

http://antispam.imp.ch/rules/asciispam.cf

Maybe it is useful for you.

Martin