Spammers catching on

[David Relson]

At 09:17 AM 12/23/02, Parker Morse wrote:

>I spotted this in a spam that made it through our filters this weekend:
>
>X-Mime-Key: search words: suspensory repanel naker picarian naaman unvirtuous
>
>I can only guess that's an attempt to skew statistical-analysis filters 
>like bogofilter, since of course it had nothing to do with the actual message.
>
>pjm

Parker,

That would have NO effect on my mail server.  I'm running the 
Robinson-Fisher algorithm with default ROBX (0.415) and min_dev set to 
0.1  The effect is that unknown words get a spamicity score of 0.415 and 
are then ignored because they are within min_dev of 0.5.

More interesting is the multipart messages with an invisible copy of Little 
Red Riding Hood, or other innocuous story.  The story skews the results 
toward spam.

Bogofilter's "-v" option can be used to learn more about _why_ bogofilter 
gives a message a particular score.  Option "-vv" used with Robinson or 
Robinson-Fisher wlll generate a histogram of a message and show you how 
many good/bad words are in the message.  "-vvv" or "-R" will list all the 
words and their scores.

David