> -----Original Message----- > From: Todd Schuldt [mailto:[EMAIL PROTECTED] > Sent: Thursday, August 14, 2003 1:27 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] quick survey > > > > We are running the same setup you are on our domain and > noticed the same > thing. > > From what we can tell from ours is that the ones that get through are > html based with the letters of the words split up between markup code. > The pattern is mainly things like {html markup code} b {html markup > code} u {html markup code} y {html markup code} that then displays as > the word "buy" when viewed. > > I have no clue how to adjust for this technique without something like > razor added to the pure SA 2.55 since the html markup codes are never > the same across messages. I though about trying to put in a third > program that would convert the html to plain text, scan and score it > based on the plain-text version with SA and then merge the SA headers > back into the original html message and pass that file back > to the MTA. > (Which feels like a lot of pain for little gain) > > Todd >
Guess I have to middle post :-) There are some HTML OBFU rules at the SA Rule Emporium in my sig link. Also, I have been thinking of exactly what you have been thinking. Spawning off a clone process in procmail to de-HTML the email (will body only work?), run spamassassin on the de-html version, and either dump the score to a variable or a temp file to be added to the next process of the standard spamc run. Reason I haven't? Does seem like a lot of overhead and work for a simple gain. So I'm still trying to just grab these spam tokens via regular rules. *Bayes aside* HTH Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Matt > Thoene > Sent: Thursday, August 14, 2003 10:58 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] quick survey > > Hi, > > I'm running version 2.55, no custom rules, with a spam threshold of 3. > It's been working great, catching every single spam and only > one or two > fp's a week. Within the last week however, I've started to > get about 2-4 > spams a day sneaking under my 3 threshold. Is anyone else experiencing > this? Is it just the spammers adjusting to 2.55? > > -- > Regards, > Matt > > > > ------------------------------------------------------- > This SF.Net email sponsored by: Free pre-built ASP.NET sites including > Data Reports, E-commerce, Portals, and Forums are available now. > Download today and enter to win an XBOX or Visual Studio .NET. > http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet _072303_01 /01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
