[spambayes-dev] Interesting unsure

[T. Alexander Popiel]

In message:  <16122.5831.713436.903045 at montanaro.dyndns.org>
             Skip Montanaro <skip at pobox.com> writes:
>
>Except note that they weren't accenting every vowel and there were
>many other accents to choose from.  The message I received had
>"mak=EB" and "te=EBn".  There are several other accented characters
>with "a" or "e" as their base character.  I would have to receive
>many messages using this technique to build up enough such odd words
>to make a difference.

Also note that the message was already on the high end of unsure (0.78),
and spammers don't seem to be all that creative in the nonsense words
they use ("jvw", "sliceor", "tiper", and "tipor" have all shown up
frequently enough for me so that they're strong spam indicators).  It
wouldn't take much to tip the mail into the spam bucket, and the spammers
will probably stick with a couple misspellings more than long enough to
be recognizable.

>I think that's the spammer's basic idea with this - keep it readable
>but fly below the word count radar.

Certainly... and it'll work for about a day, each time they come up
with new misspellings.  It's probably too expensive (or too technical)
for them to generate fresh accent permutations for every spam they
send.

>The fundamental problem when dealing with new spam techniques is (and
>will always be, I think) when to mount a counterattack.  That's
>certainly the case here.

Agreed.  My gut feeling is not to bother until it's been an actual
problem for a week.

- Alex