Some of these can be found on Chris' site <http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm> Hope this helps. MK_BAD_HTML_10 wouldn't catch it, but in those same emails I have seen the spammer using <!blah><!blah><!blah>. Can't hurt.
Mike ------Begin Rules----- #Added 7/31/2003 #This takes care of <!asde> rawbody __MK_BAD_HTML_7 /\<![a-zA-CE-Z]/ #This takes care of tags that don't exist such as <zebra> #The last / is in there so it doesn't freak out about closing tags. #<KBD> is a valid tag, but I don't believe we'll see it in email. #8/5/2003 Added in to not pickup <[EMAIL PROTECTED]> rawbody __MK_BAD_HTML_8 /\<[^abcdefhilmopstuv\/[EMAIL PROTECTED],80}\>/i #This takes care of closing tags that don't exist such as </zebra> rawbody __MK_BAD_HTML_9 /\<\/[^abcdefhilmopstuv]/i #8/4/2003 Added in ? due to MS <?xml:blahblah> tag rawbody __MK_GOOD_HTML_1 /\<\??xml/i #The next three are a combo of the above three. Plain text replies will # get thrown off by __MK_BAD_HTML_8 #Upped score 8/27/2003 meta MK_BAD_HTML_10 HTML_MESSAGE && __MK_BAD_HTML_7 describe MK_BAD_HTML_10 Bad HTML form. HTML Tag <!blah> that does not exist used. score MK_BAD_HTML_10 1.2 #This tags <noframes>. It's not a legit tag meta MK_BAD_HTML_11 HTML_MESSAGE && __MK_BAD_HTML_8 && !__MK_GOOD_HTML_1 describe MK_BAD_HTML_11 Bad HTML form. HTML beginning tag that does not exist used. score MK_BAD_HTML_11 0.3 #This tags </noframes>. It's not a legit tag meta MK_BAD_HTML_12 HTML_MESSAGE && __MK_BAD_HTML_9 describe MK_BAD_HTML_12 Bad HTML form. HTML closing tag that does not exist used. score MK_BAD_HTML_12 0.3 #Hiding words within a <FRAME><NOFRAME> combo. No such thing as NOFRAME meta MK_HIDING_IN_FRAMES_1 HTML_RELAYING_FRAME && MK_BAD_HTML_12 && MK_HIDING_IN_FRAMES_2 describe MK_HIDING_IN_FRAMES_1 Bad HTML form. Trying to hide a word in frame, what a shame. score MK_HIDING_IN_FRAMES_1 2.9 rawbody MK_HIDING_IN_FRAMES_2 /\<FRAME\>\<NOFRAMES\>/i describe MK_HIDING_IN_FRAMES_2 Bad HTML form. Uses a frame/noframes combo. score MK_HIDING_IN_FRAMES_2 1.8 rawbody MK_HIDING_IN_FRAMES_3 /\<FRAME\>\<NOFRAME\>/i describe MK_HIDING_IN_FRAMES_3 Bad HTML form. Uses a frame/noframe combo. score MK_HIDING_IN_FRAMES_3 1.8 -----Original Message----- From: Keith McDufffee [mailto:[EMAIL PROTECTED] Sent: Saturday, August 30, 2003 2:11 PM To: [EMAIL PROTECTED] Subject: [SAtalk] Yet another masking trick Has anyone seen this trick yet? <b>Viewing P<frame><noframes>iulhix2k7f9z72</noframes>orn from Work?</b> Got any ideas for rules for that one? ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
