Re: Weird characters (again) getting around filter rules.

Martin - replace_tag looks interesting.  I will give that a try. 
Especially now that I think I've finally squashed the "Complimentry Road 
Kit" and free Costco Memberships with free"Keurig K-Elite Coffee 
Machine" and other appliances. Are other people getting these?   Always 
something.  - Mark

On 12/16/2025 10:16 PM, [email protected] wrote:
> Subject:
> Re: Weird characters (again) getting around filter rules.
> From:
> "Martin F via users" <[email protected]>
> Date:
> 12/16/2025, 6:05 AM
>
> To:
> [email protected]
> CC:
> Martin F <[email protected]>
>
>
> I've had to deal with quite a bit of obfuscated spam over the years.
> I started out having every possible obfuscation in every rule, and 
> whenever i discovered a new one, i needed to go back and update every 
> single rule with the new one. The rules were massive and completely 
> unreadable.
> Then i discovered replace_tags, which i can highly recommend looking 
> into, if you haven't already:
> https://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Plugin_ReplaceTags.html
> https://github.com/apache/spamassassin/blob/trunk/rules/25_replace.cf
> Using this made the rules so much easier to read when you come back to 
> them 6 months from now, and it's much easier to reuse the same 
> obfuscations. Just update it in one place and it applies to all rules 
> using them.
> (Sorry, that sounded like a horrible sales-pitch from a 
> TV-advertisement or something..)
>
> I've found the builtin rules are occasionally missing some special 
> characters, so i made a replace_tag for every letter where i include 
> the built-in one. Here's a couple of examples:
> replace_tag        CUSTOM_C (<C>|\xe1\xb4\x84)
> replace_tag        CUSTOM_N (<N>|\xe2\x93\x9d|\xc6[\x9e\x9d]|\xef\xbd\x8e)
> replace_tag        CUSTOM_V            (<V>)
>
> Then i can add other custom characters i find to each letter there, if 
> the built-in rules are not catching the obfuscation.
> I've found the easiest way to get the characters is a quick python 
> for-loop:
> >>> for c in "ṣҿṽҿral":
> ...     print(f"{c}: {c.encode('utf8')}")
> ...
> ṣ: b'\xe1\xb9\xa3'
> ҿ: b'\xd2\xbf'
> ṽ: b'\xe1\xb9\xbd'
> ҿ: b'\xd2\xbf'
> r: b'r'
> a: b'a'
> l: b'l'
>
> In the end, you can make either one rule that catches both the normal 
> and obfuscated versions, or separate them so you can punish obfuscated 
> versions even harder:
> body        __BODY_VIAGRA 
> /(^|[^a-zA-Z0-9\.]|<CUSTOM_WORD_SEP>)viagra([^a-zA-Z0-9]|$)/i
> body        __BODY_VIAGRA_OBF 
> /(^|[^a-zA-Z0-9]|<CUSTOM_WORD_SEP>)(?!\bviagra\b)<CUSTOM_V><CUSTOM_I><CUSTOM_A><CUSTOM_G><CUSTOM_R><CUSTOM_A>([^a-zA-Z0-9]|$)/i
> replace_rules    __BODY_VIAGRA __BODY_VIAGRA_OBF
>
> I would say start out with the built-in ones from the 25_replace.cf 
> file, and if you see they're not catching certain characters, start 
> creating your own versions and add those characters.
>
> As others have pointed out, it might cause issues if you actually have 
> people writing in languages that use those special characters, but 
> that's the eternal joy of managing a spam-filter..
>