Click here to get rid of any annoying frames

TOC


procmail recipie request for new spammer technique

Newsgroups: comp.mail.misc
Date: 26 Feb 2003 20:16:40 GMT

> New spam is coming across that has html comment code in it that is
> designed to thwart spam-detection recipies.

> How can I check the first 3 lines of a message and see if it has more
> than 5 occurences of '<!' (ignore the quote mark) ?

I used a rule to delete "comments" in a word with this rule. e.g. po<!--nonsense-->rn

:0 HBfbw

Shortly after making the recipe, i changed to bogofilter for spam checking so it has not been tested much.

Leo


procmail recipie request for new spammer technique

> We are running RH7.2 and couldn't get bogofilter to run due to the
> "judy" refusing to operate. When I got no response from the "judy" or
> "bogofilter" people, I took out both of them.

I dont know about judy. On debian it seems to run just fine without it.

> So, i need to setup something here on my own :(

Maybe you could try scoring. Something like (untested)

: 0Bh

The idea is that if there is more than 5 "<!" comments it is deleted. Have a look in man procmailsc.

> What is "rudy" in your pipe command?

Ruby is a brilliant scripting and programming language. Doesn't everybody use it?

Leo


procmail recipie request for new spammer technique

> OK, dl'ed the latest and greatest stable build yesterday and it
> installed. Went through the documentation but couldn't see how to
> train bogofilter with messages that you know are spam and that were
> saved.

Just pipe some known spam to "bogofilter -s", and some ordinairy mail to "bogofilter -n".
It is in the man page.

> Are there any goodlist.db and spamlist.db files available to the
> public?

The point is that bogofilter is adapted to your personal "patern".

Leo


procmail recipie request for new spammer technique

Oh, I didn't realize that when the manual switches from "message" to "text" it meant the same thing.

Got it going, thanks.

Your name


procmail recipie request for new spammer technique

> How do you even install ruby (Debian Linux) ? Where do you learn about
> it?

The Ruby website is

http://www.ruby-lang.org/

There's a .deb for it at

http://packages.debian.org/unstable/interpreters/ruby.html

Tim


Last updated on: Fri Dec 26 11:03:43 EST 2003

TOC

SourceForge.net Logo