Re: Why is this type of spam not caught?

On 21 Nov 2006, Matthias B. wrote:
> On Mon, 20 Nov 2006 11:23:26 +0000 Anthony Campbell <ac-MeA/[email protected]>
> wrote:
> 
> > I'm getting lots of mail which always have the same first line in the
> > body:
> > 
> > 	Deborah has uploaded some new software for you!
> > 
> > The name changes but the text remains the same.
> > 
> > Apart from this there is a link to click plus a lot of randomly selected
> > text related to free software.
> > 
> > However many times I feed these to spamprobe it keeps failing to catch
> > the next version that arrives. I should have thought the constant
> > repetition of the first line would be a give-away. Is there any way to
> > make spamprobe look out for a particular phrase like this?
> 
> I have the same problem. I guess SP fails, because the body texts of these
> messages seem to be copied together from posts to technical mailing lists
> and therefore are very hammy. You wouldn't want a good mail discarded just
> because the sender chose a bad subject and has a single spammy paragraph
> in the mail (which could be a signature auto-appended by a freemail
> service).
> 
> These spams worry me very much, because if you keep training them as
> spam they poison many good terms. E.g. on my SP database "lpd" has turned
> into a spam term as have the phrases "boot floppy" and "source route". 
> These are terms that I would expect in ham messages on the kind of mailing
> lists I read. Seeing them tagged as spam phrases gives me a bad feeling.
> I'm just waiting for "FreeBSD" (seems to be contained in all of those
> messages) to turn into a spam term. I hate to say it, but including random
> snippets from Usenet or mailing list postings in spam was a very smart
> move by the spammers. The interesting thing is that they chose technical
> mailing lists as source. I don't think that's because the people reading
> this kind of stuff are especially likely to fall for spam. Maybe it's
> hostility towards the people who write and install antispam software, an
> attempt to poison their ham terms to annoy them?
> 

It's a beautiful illustration of Darwininsm in action!

I resorted to putting the first line of the body into .procmailrc:

	# catch stuff with this line in body
	:0 B
	*has uploaded some new software for you!
	junkmail

This works, but of course it caught your post too!

Anthony



-- 
Anthony Campbell - ac-MeA/[email protected] 
Microsoft-free zone - Using Linux Gnu-Debian
http://www.acampbell.org.uk (blog, book reviews, 
on-line books and sceptical articles)


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV