Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SpamAssassin: users

Interword capitalization

 

 

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded


mynabble at live

May 2, 2011, 1:53 AM

Post #1 of 9 (767 views)
Permalink
Interword capitalization

Does someone have a rule for interword capitalization? Or more specific,
something to score stuff like:

Subject = At tai nWel l- bei ngGoa lsVeryEf fe ctiv eTabl et


--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31521819.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


mynabble at live

May 10, 2011, 4:59 AM

Post #2 of 9 (710 views)
Permalink
Re: Interword capitalization - solved [In reply to]

Mynabbler wrote:
>
> Does someone have a rule for interword capitalization?
>
Unfortunately no takers for the question. I came up with this:

# Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
tflags __MN_IWCAP multiple
meta MN_IWCAP __MN_IWCAP >= 3
score MN_IWCAP 0.1
meta MN_FMIWCAP (MN_IWCAP && FREEMAIL_FROM)
score MN_FMIWCAP 3
describe MN_FMIWCAP Found thRee intErword caPitalizations from a free
mail address

It searches for three or more occurrences in the subject and scores it when
coming
from a freemail address (just hotmail would have been enough... sigh).

--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31584892.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


Bowie_Bailey at BUC

May 10, 2011, 6:01 AM

Post #3 of 9 (700 views)
Permalink
Re: Interword capitalization - solved [In reply to]

On 5/10/2011 7:59 AM, Mynabbler wrote:
>
> Mynabbler wrote:
>> Does someone have a rule for interword capitalization?
>>
> Unfortunately no takers for the question. I came up with this:
>
> # Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
> tflags __MN_IWCAP multiple
> meta MN_IWCAP __MN_IWCAP >= 3
> score MN_IWCAP 0.1
> meta MN_FMIWCAP (MN_IWCAP && FREEMAIL_FROM)
> score MN_FMIWCAP 3
> describe MN_FMIWCAP Found thRee intErword caPitalizations from a free
> mail address
>
> It searches for three or more occurrences in the subject and scores it when
> coming
> from a freemail address (just hotmail would have been enough... sigh).

So hopefully you aren't expecting any emails from a Hotmail user
discussing iPods or iPads....or McDonalds.... :)

--
Bowie


mynabble at live

May 10, 2011, 6:22 AM

Post #4 of 9 (700 views)
Permalink
Re: Interword capitalization - solved [In reply to]

Bowie Bailey wrote:
>
>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
>> tflags __MN_IWCAP multiple
>> meta MN_IWCAP __MN_IWCAP >= 3
>
> So hopefully you aren't expecting any emails from a Hotmail user
> discussing iPods or iPads....or McDonalds.... :)
>

It searches for three occurrences or more. So, they would ought to compose a
subject like "Shall I bring my iPod or my iPad to McDonalds", and daft
enough to be using a free mail provider. Yes. In the meantime I only see the
rule hitting spam:

Subject: Typ eOfCap sule sSa tis fac tor yForVerySt ric tBuy er s
Subject: SeeLate stPill sAma zingAdv ant ages
Subject: TakeAdv an tag eOfToda y' sNe wTabl ets
Subject: No velPillOff erAHoli sti cPro ce ssToHe al th

... and it is interesting to see how long it takes for the ruLese tTob ecoMe
oBso letE because of changed tactics after publicly publishing a specific
rule.
--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31585518.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


Bowie_Bailey at BUC

May 10, 2011, 7:22 AM

Post #5 of 9 (700 views)
Permalink
Re: Interword capitalization - solved [In reply to]

On 5/10/2011 9:22 AM, Mynabbler wrote:
> Bowie Bailey wrote:
>>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
>>> tflags __MN_IWCAP multiple
>>> meta MN_IWCAP __MN_IWCAP >= 3
>> So hopefully you aren't expecting any emails from a Hotmail user
>> discussing iPods or iPads....or McDonalds.... :)
> It searches for three occurrences or more. So, they would ought to compose a
> subject like "Shall I bring my iPod or my iPad to McDonalds", and daft
> enough to be using a free mail provider. Yes. In the meantime I only see the
> rule hitting spam:
>
> Subject: Typ eOfCap sule sSa tis fac tor yForVerySt ric tBuy er s
> Subject: SeeLate stPill sAma zingAdv ant ages
> Subject: TakeAdv an tag eOfToda y' sNe wTabl ets
> Subject: No velPillOff erAHoli sti cPro ce ssToHe al th
>
> ... and it is interesting to see how long it takes for the ruLese tTob ecoMe
> oBso letE because of changed tactics after publicly publishing a specific
> rule.

Ah. I missed the meta limiting it to 3 or more hits. If it works well,
maybe we can add it to the stock ruleset.

--
Bowie


mynabble at live

May 10, 2011, 7:33 AM

Post #6 of 9 (701 views)
Permalink
Re: Interword capitalization - solved [In reply to]

Bowie Bailey wrote:
>
> Ah. I missed the meta limiting it to 3 or more hits. If it works well,
> maybe we can add it to the stock ruleset.
>
Step 1 would be a check in someone's sandbox. And maybe a better meta than
freemail, since I do see some false positives in yahoo groups:

Spamassassin found from <XXX [at] returns> at
n73c.bullet.mail.sp1.yahoo.com [98.136.45.72] HELO
n73c.bullet.mail.sp1.yahoo.com to <XXX>
...snip,DKIM_SIGNED,DKIM_VALID,FREEMAIL_FROM,CAPSNOSPACE,MN_FMIWCAP,snip...
Subject: Re: [RebornDollsArtistCircle] Hello

so... a freemail post to a yahoo group that has three interword capitals in
the groupname is a false positive (in this case, by the way, the group
message _was_ spam).

A not 'CAPSNOSPACE' or a not yahoogroups would be in order to solve that.

CAPSNOSPACE is:

# Junk with CapsCrapMessageSubjects
header MN_CAPSNOSPACE Subject =~ /(?:[A-Z][a-z]+){4}/
describe MN_CAPSNOSPACE Subject ContainsFourWordsLikeThis
score MN_CAPSNOSPACE 1

--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31586088.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


jdow at earthlink

May 11, 2011, 12:50 AM

Post #7 of 9 (695 views)
Permalink
Re: Interword capitalization - solved [In reply to]

Help! My iPad does not work on FaceBook.

Bet that hits it as a subject.

{^_-}

On 2011/05/10 06:01, Bowie Bailey wrote:
> On 5/10/2011 7:59 AM, Mynabbler wrote:
>>
>> Mynabbler wrote:
>>> Does someone have a rule for interword capitalization?
>>>
>> Unfortunately no takers for the question. I came up with this:
>>
>> # Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
>> tflags __MN_IWCAP multiple
>> meta MN_IWCAP __MN_IWCAP>= 3
>> score MN_IWCAP 0.1
>> meta MN_FMIWCAP (MN_IWCAP&& FREEMAIL_FROM)
>> score MN_FMIWCAP 3
>> describe MN_FMIWCAP Found thRee intErword caPitalizations from a free
>> mail address
>>
>> It searches for three or more occurrences in the subject and scores it when
>> coming
>> from a freemail address (just hotmail would have been enough... sigh).
>
> So hopefully you aren't expecting any emails from a Hotmail user
> discussing iPods or iPads....or McDonalds.... :)
>


mynabble at live

May 11, 2011, 3:58 AM

Post #8 of 9 (693 views)
Permalink
Re: Interword capitalization - solved and improved [In reply to]

jdow wrote:
>
>>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
> Help! My iPad does not work on FaceBook.
> Bet that hits it as a subject.
>

Nope. Matches only two times..., on the P from iPad and the B from FaceBook.
It does not match the F.

Getting back to the matter at hand: is someone able to put that ruleset in a
sandbox for the daily run?

A 'yahoo groups' would be:

header __MN_YHGRP Return-path =~ /returns\.groups\.yahoo\.com/

and the better meta with ruleset and not yahoogroups could be:

# Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
tflags __MN_IWCAP multiple
meta MN_IWCAP __MN_IWCAP >= 3 && !__MN_YHGRP
score MN_IWCAP 0.01

meta MN_FMIWCAP MN_IWCAP && FREEMAIL_FROM
score MN_FMIWCAP 3

--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31593215.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


jdow at earthlink

May 11, 2011, 4:43 AM

Post #9 of 9 (695 views)
Permalink
Re: Interword capitalization - solved and improved [In reply to]

Add "on YouTube" and Bob's your uncle.

But it is a tad contrived.

{^_-}

On 2011/05/11 03:58, Mynabbler wrote:
>
>
> jdow wrote:
>>
>>>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
>> Help! My iPad does not work on FaceBook.
>> Bet that hits it as a subject.
>>
>
> Nope. Matches only two times..., on the P from iPad and the B from FaceBook.
> It does not match the F.
>
> Getting back to the matter at hand: is someone able to put that ruleset in a
> sandbox for the daily run?
>
> A 'yahoo groups' would be:
>
> header __MN_YHGRP Return-path =~ /returns\.groups\.yahoo\.com/
>
> and the better meta with ruleset and not yahoogroups could be:
>
> # Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
> tflags __MN_IWCAP multiple
> meta MN_IWCAP __MN_IWCAP>= 3&& !__MN_YHGRP
> score MN_IWCAP 0.01
>
> meta MN_FMIWCAP MN_IWCAP&& FREEMAIL_FROM
> score MN_FMIWCAP 3
>

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.