I came up with another idea to tackle these, I really liked that spam, you
can say it inspired me because it too slipped past my SA rules!
full FVGT_rb_WICKED_SPAM_12
/<td.{10,400}<br>.{1,2}<br>.{1,2}<br>.{1,2}<br>.{0,400}<\/td>/is
describe FVGT_rb_WICKED_SPAM_12 Hide message with large complex tables 1-2
score FVGT_rb_WICKED_SPAM_12 1.5
full FVGT_rb_WICKED_SPAM_3
/<td.{10,400}<br>.{3}<br>.{3}<br>.{3}<br>.{0,400}<\/td>/is
describe FVGT_rb_WICKED_SPAM_3 Hide message with large complex tables 3
score FVGT_rb_WICKED_SPAM_3 1.5
full FVGT_rb_WICKED_SPAM_4
/<td.{10,400}<br>.{4}<br>.{4}<br>.{4}<br>.{0,400}<\/td>/is
describe FVGT_rb_WICKED_SPAM_4 Hide message with large complex tables 4
score FVGT_rb_WICKED_SPAM_4 1.5
full FVGT_rb_WICKED_SPAM_56
/<td.{10,400}<br>.{5,6}<br>.{5,6}<br>.{5,6}<br>.{0,400}<\/td>/is
describe FVGT_rb_WICKED_SPAM_56 Hide message with large complex tables 5-6
score FVGT_rb_WICKED_SPAM_56 1.5
full FVGT_rb_WICKED_SPAM_7
/<td.{10,400}<br>.{7}<br>.{7}<br>.{7}<br>.{0,400}<\/td>/is
describe FVGT_rb_WICKED_SPAM_7 Hide message with large complex tables 7
score FVGT_rb_WICKED_SPAM_7 1.5
Frederic Tarasevicius
Internet Information Services, Inc.
http://www.i-is.com/
810-794-4400
mailto:[EMAIL PROTECTED]
----- Original Message -----
From: "Chris Santerre" <[EMAIL PROTECTED]>
To: "'Colin A. Bartlett'" <[EMAIL PROTECTED]>;
<[EMAIL PROTECTED]>
Sent: Tuesday, November 04, 2003 4:29 PM
Subject: RE: [SAtalk] [RD] excessive table tags
> > I have a rule challenge for you all.
>
> Accepted :-)
>
> >
> > How can we write a rule to catch messages like the one
> > attached? I have had
> > a few slip through today like this. As did Ray Dzek who
> > attached a similar
> > message in his post "What is with all this ()*&(*& in my
> > inbox?". It seems
> > that they are using a lot of seperate cells to screw with Bayes and
> > obfuscate all the text. This message even misses BANG_OPRAH
> > because of it.
> >
> > I'm not sure there is an easy way to test for this, short of
> > creating a mini
> > HTML renderer. Can anyone think of a good starting point?
> > Anyone else get
> > messages like these often?
> >
> > cheers,
> > Colin
> >
>
> Just needs a variation of my older rule:
>
> rawbody MY_MANY_BR /<br><br><br><br><br>/i
> describe MY_MANY_BR Tooo many <br>'s!
> score MY_MANY_BR .45
>
> maybe something like this:
>
> rawbody MY_MANY_BR2 /<br>.{6,14}<br>.{6,14}<br>.{6,14}<br>.{6,14}<br>/i
> describe MY_MANY_BR2 Tooo many <br>'s!
> score MY_MANY_BR2 .45
>
> And so on.....
>
> Chris Santerre
> System Admin and SA Custom Rules Emporium keeper
> http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
> "A little nonsense now and then, is relished by the wisest men." - Willy
> Wonka
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: SF.net Giveback Program.
> Does SourceForge.net help you be more productive? Does it
> help you create better code? SHARE THE LOVE, and help us help
> YOU! Click Here: http://sourceforge.net/donate/
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
