Re: Weird characters (again) getting around filter rules.

On 2025-12-14 at 20:04:10 UTC-0500 (Sun, 14 Dec 2025 20:04:10 -0500)
Mark London <[email protected]>
is rumored to have said:

> Hi - One of users got a bitcoin blackmail email, that use special 
> characters to avoid the bitcoin spam rules.   Does anybody have 
> rules that detect this type of obfuscation?  Thanks. - Mark

There's one that is already in the rules named "MIXED_ES" which could 
probably be expanded/replicated to other lookalike sets but it is 
relatively expensive. The idea I used there was that there should be few 
messages that use many ASCII 'e' characters but also uses many non-ASCII 
e-like characters, of which there are many flavors. MIXED_ES is a solid 
rule with good scores, but it is also necessary for some sites that get 
a lot of Eastern European mail to disable it, as there apparently isn't 
a great way to protect normal Polish or Czech usage from occasionally 
hitting the rule.

However, I do have a suggestion for this particular case:

> Begin forwarded message:
>
>> *From:* Ashley Adkins <[email protected]>

It is likely to be safe to reject all mail with '<[email protected]>' 
in the From header. As far as I can tell, Google doesn't use that 
specific address.


>> *Date:* December 12, 2025 at 3:51:30 PM EST
>> *Subject:* *Reminder! Check this message now*
>>
>> 
>> Greetings!
>>
>> I nҿҿd to inform bad nĕwṣ with you.
>>
>> Approximately ṣҿṽҿral monthṡ ago I obtainễd accȩṡṡ to 
>> your gadgễtŝ, which you uṩẽ for wҿb _(krxvtgqb) _ṣurfing. 
>> Aftҿr that, I _(qofyata) _haⱱê ṥtartȅd tracking your 
>> intẹrnẹt activities.
>>
>> Here iṩ thḗ ṣȇquȇncȇ of events:
>>
>>



-- 
  Bill Cole
  [email protected] or [email protected]
  (AKA @[email protected] and many *@billmail.scconsult.com 
addresses)
  Not Currently Available For Hire