[Spambayes] Spam that bypasses spambayes

Harri Pesonen harri.pesonen at wicom.com
Wed Sep 10 10:30:04 EDT 2003


I had an idea a couple of weeks ago, that all url tokens should have
more weight than other tokens. The spammer just wants you to click on 
some url, so the other text is not so important. They could even put
random words there, and they have.

And maybe the url server address should be tokenized the same way as the
address is tokenized in Received header. So the address below would
yield

url:biz
url:gadgitz.biz
url:www.gadgitz.biz

Now it just does

url:www
url:gadgitz
url:biz

Maybe it should do both and have more weight that way. Also decode %
encoding and find server names for ip addresses... :-)

Harri

-----Original Message-----
From: "Mark Jeays" <mjeaya069 at rogers.com>

I've been getting some messages recently that seem to fight bayesian
filters
directly and are getting through with ease (under 0.05). Any thoughts on
spambayes performance on these? Is there a chance of catching them?
Currently my database is at a mere 134 real email (this is not my
primary
account) and a disturbing 3674 spam.

Exhibit A:

***
hey what's up...it's been a while...i'm just on my way out but i wanted
to
let you know about  this really cool
product I saw on TechTv, I found a website that is selling it dirt cheap
so
you may want to grab one while you
can, the link is below....gotta take off, later

http://www.gadgitz.biz/promo.php?id=93778
***

Exhibit B:

***
Hi, haven't heard from in awhile, what's up? I'm still at that company
working away. Boring as always. I just got a heard about an awesome
website
that's saving me tons of money already on my medications.
I'm getting most my stuff their now as it's the cheapeast I've
found online, and it's fast. With the secure site and Live overnight
tracking it's safe & you can't
really go wrong. Check it out, may save you some extra dollars.
Anyways, I'll put link below. Say Hi to everyone and take care.

http://www.pharmacysale.biz/pharm/
***

Do I just need to wait a bit for "overnight" and "tracking" and
"medications" to increase their spamminess number? I suppose so...

Regards,

Mark Jeays



More information about the Spambayes mailing list