Re: [Declude.JunkMail] OBFUSCATION filter

[Matthew Bramble]

Bill (and others), if you find an exclusion, would it be possible to post the offending code to the list?  This way I can keep track of the types of things FP'ing with the test and remove code that isn't necessarily useful. I think I found the PayPal issue, seems that they have a program that isn't filling in a variable in this tag:     <img src="" class="moz-txt-link-rfc2396E" href="http://%3%/images/pixel.gif">"http://%3%/images/pixel.gif" height="5" width="1" border="0"> It's a broken tag instead of them trying to obfuscate the address.  It's hitting the following line in that filter:     BODY        0    CONTAINS    http://% The tests with HTTP stuff could be overkill and it opens the possibility of hitting http:// followed by a non-number or letter.  Maybe I should remove those test instead of removing PayPal?  I doubt the test will be measurably weaker without the lines that do this type of thing.  I think that's what I'll do just to be safe. In a day or so, I'll just start putting these in a folder on my site instead of posting them to the list so that people's filters don't start hitting them.  Of course I would recommend whitelisting either the group, or better yet Declude in the subject, that way PM's from the list don't get blocked. Matt Bill Landry wrote: Just an FYI, I've added: MAILFROM -7 ENDSWITH paypal.com to the "Test Exclusions", as it was flagged by the Obfuscation test. Bill ----- Original Message ----- From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, September 14, 2003 12:27 PM Subject: Re: [Declude.JunkMail] OBFUSCATION filter Thanks Bill. And I've got a few more in me I believe :) Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- =================================================== Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of NYcars.com --------------------------------------------------- Office Phone: (518) 862-9042 Cellular: (518) 229-3375 Fax: (518) 862-9044 E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] ===================================================