________________________________
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mark
Ritchie
Sent: Wednesday, October 29, 2003 7:14 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Exessive HTML Code
I've added the popcorn, blackhair, and weeds rules a while back, but
I've noticed that I'm still getting quite a few spams messages per day. It
always seems to be the most offensive porn and such that makes it through.
Here is an example of the source that get's through
<HTML><html>
<body bgcolor="#FFFFFF">
<p> NOT m<i></i>atu<b></b>re<i></i>,
e<i></i>xpe<i></i>ri<i></i>enc<i></i>ed. NOT cheat<i></i>ing, on t<b></b>he
s<i></i>i<i></i>de. <br>
<b></b>NOT fli<i></i>rtin<i></i>g <b></b>-
t<b></b>h<i></i>i<b></b>s is 2003's fine<i></i>st
a<i></i>l<b></b>t<b></b>er<b></b>na<b></b>tive dating
lifes<b></b>tyl<i></i>e <b></b>sol<i></i>ut<i></i>io<i></i>n
w<i></i>it<i></i>h
tho<i></i>u<i></i>sands o<i></i>f h<b></b>or<b></b>ny
housewive<b></b>s<i></i>.<br>
An<i></i>d <i></i>yo<b></b>u, Y<i></i>ES, Y<b></b>O<i></i>U,
<i></i>can g<b></b>e<b></b>t a<b></b>ccess to t<b></b>h<i></i>e
<b></b>wh<b></b>o<i></i>le d<i></i>a<b></b>ta<b></b>ba<i></i>se of
USA-<b></b>loc<b></b>a<i></i>te<i></i>d hou<i></i>sewi<b></b>ves
wh<i></i>o'r<i></i>e in <i></i>fo<b></b>r
a<b></b>n<i></i>yt<b></b>hing - f<b></b>or on<b></b>e
b<b></b>uck<b></b>!<br>
HYLF<b></b>! H<b></b>ousew<b></b>iv<i></i>es You<i></i>'d Like
<b></b>to <b></b>Fl<b></b>ir<b></b>t and F<i></i>u<i></i>ck -
<b></b>yea<i></i>h, <b></b>y<i></i>ou'd de<b></b>fin<b></b>i<i></i>tely
w<b></b>ant
<i></i>to <b></b>do th<i></i>at, <i></i>wh<i></i>y on Ear<b></b>th
<i></i>woul<b></b>d you da<b></b>te, <b></b>anyw<i></i>ays?</p>
<p> <a
href="http://www.find-chat.com/cheating/wives.html";>Clic<b></b>k here
<b></b>and p<b></b>a<b></b>y
1$ t<b></b>o <b></b>y<b></b>our r<i></i>ow of
g<i></i>lor<i></i>ious ho<b></b>us<b></b>e<i></i>wife affairs!</a> </p>
<br>
<br>
<p><a href="http://www.a1hostingdirect.com/gone.html";><b></b>No
Mor<b></b>e Thanks</a></p>
</body>
</html></HTML>
Now, as you can see the trick here to fool spamassassin is the <i>
and <b> tags. Would it be possible to make a rule or adjust the rules so
the <i></i> scores high? There is nothing inbetween and I'd have to say
anyone sending messages like this is obviously a spammer.
--------------------------------------
Maybe a rule like this:
rawbody MY_R_USELESSTAGS /<.><\/.>.{0,10}<.><\/.>.{0,10}<.><\/.>.{0,10}/I
describe MY_R_USELESSTAGS Message contains multiple useless html tags
score MY_R_USELESSTAGS 0.5
Just an idea, this has not been tested at all, but it may work for this type
of message, also you could create your own URI rules and and the domains
included in these messages.
-matt
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
