On Tue, Jan 07, 2003 at 04:03:23PM -0500, [EMAIL PROTECTED] wrote:
> Check this message (scroll down until you see </html> tag!)
The copy of this spam that I got scored 7.7 against my filters.
X-Spam-Status: Yes, hits=7.7 required=5.0
tests=CTYPE_JUST_HTML,HTML_PRE,MAILTO_LINK,ONE_PIXEL_IMG,
RCVD_IN_BL_SPAMCOP_NET,SPAM_PHRASE_02_03,WEB_BUGS
version=2.43
I have WEB_BUGS cranked up to 1.15, bl.spamcop.net at 2.45, and two of
those rules are mine:
ONE_PIXEL_IMAGE scores 1.95 for HTML referencing a single-pixel image.
It depends on a couple of other meta rules, which may or may not work
in stock SA 2.43. (The __A prefix is because I have mine sorting meta
rules alphabetically, and won't be necessary with 2.50.)
header __MULTIPART Content-Type =~ /^multipart\/(?:alternative|related|mixed)/
# This is not exactly precise, but should be good enough.
rawbody __HTML_PART /^Content-Type: text\/html/
meta __A_HTML_MAIL (__CTYPE_IS_HTML || (__MULTIPART && __HTML_PART))
rawbody __ONE_PIXEL_IMG
/\<img[^>]{1,90}(?:height|width)=\"?1\"?[^>]{1,20}(?:width|height)=\"?1\"?/ims
meta ONE_PIXEL_IMG (__A_HTML_MAIL && __ONE_PIXEL_IMG)
score ONE_PIXEL_IMG 1.95
describe ONE_PIXEL_IMG HTML references a single-pixel image
HTML_PRE matches the <html><body><pre> the message starts off with, for
0.75 points.
rawbody __HTML_PRE /\<html\>\<body\>\<pre\>/i
meta HTML_PRE (__A_HTML_MAIL && __HTML_PRE)
score HTML_PRE 0.75
describe HTML_PRE HTML body but preformatted text
Enjoy.
-Jeremy
-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
