Want to filter such form of spam's subject

B:E:S:T   T:R:A:N:N:Y   P:0:R:N:0   H:E:R:E !!

or

B.E.S.T   T.R.A.N.N.Y   P.0.R.N.0   H.E.R.E !!

should i make a blacklist entry like that?

B,E,S,T,T,R,A,N,N,Y

or may be only one "T" letter there above?

Unfortunately that won't work. We have not documented this yet, but the keywords need to be at least 2 characters long. We did so to avoid triggering rejections in case users had a single letter in that list.

Your solution would not be a good idea either, since the content filter would look in the whole message for those letters, not just at a single line of text, so it would be fairly easy to reject legitimate emails. This posting for example would be rejected since it does contain all of those letters.

Roberto F.
LogSat Software

To throw an idea into this discussion...

I've always thought that some sort of character filtering capability would be useful here.  Something that would allow rules-based replacement of certain characters -- ONLY in a cached COPY of the message used for testing, not in the actual message itself -- prior to keyword filtering.  In other words, the following filters could be set-up...

• Replace "0" (the number zero) with "o" (the letter O).
• Replace "#" with "h"
• Replace "!" with "i" (the letter I)
• Replace all other punctuation symbols with "" (nothing).

... and any other such rules that prove to be effective.  Please pardon the language here (this is a "clinical" discussion, not an attempt to offend; besides, if you deal with spam filtering, you see this and worse every single day)... just by using this limited set of rules, the following subject line:

Subj: SH!T, THAT B-I-T-C-# IS A W#0RE

... would be cleaned-up in the testing copy of the message... the exclamation point would be replaced with i, the #'s would be replaced with h's, the number zero would be replaced with letter o, and all other punctuation would be deleted, resulting in a subject line:

Subj: SHiT THAT BITCh IS A WhoRE

... which would then be able to trigger a case-insensitive keyword filter, if so desired.

This would filter SOME spam, but would still not do anything for those who insert space characters in hot keywords, i.e. "wh or e".  Filtering out the spaces and looking for embedded keywords just wouldn't work... "who referred you" becomes "whoreferredyou" which contains "whore", an instant false positive if you're filtering on that word.

Roberto, I think this probably goes well above and beyond your intent for SpamFilter in the here-and-now.  Just something to think about a few months from now, when you've finished the database logging functionality and everything else you're currently working on, and you're sitting around the office with nothing to do saying "what else could we do to enhance SpamFilter?" <grin>

Jim

Hi Jim,

Actually your suggestions are extremely easy to implement. We have already designed SpamFilter to do keyword matches on a COPY of the original message, since we already do massage it a bit prior to the matching. Adding the subsitutions you refer to is not hard at all, even making them user-selectable can be done rahter quickly.

On our end, just by looking at our own personal experience with what spam makes it thru SpamFilter, we don't see a lot of messages like the above that skip thru. But if we get a few more "yes, we'd really like that feature" requests here we may be able to add that in before we have a chance to sit down, relaxing, rolling our thumbs...

Roberto F.
LogSat Software

Don't forget about other languages, like cyrillic etc, there are NO latin letters are in use or may be chinees language... so this substitution is only needed to latin based languages. btw some spammers are using this tech even in russina spam. like they substitute russian letter ("i") with latin one...  it looks like shit, but they are doing it... :)