I found a rule to check for white on white text to spot possible spam.
However, I am finding that spammers are not including the body color as
white since the email client background default color is white. Thanks.
How could you write the following rule to give the email a score if , <body>
was missing from the email?
rawbody __FVGT_b_WHITEBODY
/<body>|<body.{1,25}bgcolor=.{0,3}(ffffff|white)/i
rawbody __FVGT_b_WHITEFONT /<font.{1,20}color\=.{0,3}(ffffff|white)/i
meta FVGT_m_WHITEONWHITE (__FVGT_b_WHITEBODY && __FVGT_b_WHITEFONT)
describe FVGT_m_WHITEONWHITE FVGT - Is this message trying to hide
something with white text?
score FVGT_m_WHITEONWHITE 1.5
Here is the source from the email:
<html><p><!Cole><font color=white>when, for some reason which I could not
learn, he became obnoxious</font><br><font color=black><b>O<!KzE>ur U<!J>S
Phar<!nAPo>macy i<!t>s Op<!FLL>en t<!Rt>o Yo<!Q>u!</b><br>
<font color=white>by the shoulder of the cape. Then I recalled the fact
that Moreau's</font><br>
Fu<!W>ll Selec<!Fr>tion o<!XwoU>f U<!Nei>S Lice<!Qu>nsed
Prescr<!TBhW>iptions<font color=white>this, I wish you would give me a
sentence to quote from you on this head.</font><br>
W<!xPln>e No<!Mzdq>w Ha<!YKn>ve Xan<!jYRf>ax, Vali<!M>um, Levi<!tJ>tra,
an<!XGIN>d Fas<!FMY>ter Act<!Wu>ing Via<!nWrY>gr@ Soft<!GUrk>Tabs<!you. I
gave Hooker a list of species of Silene, on which Gartner has><br>
Fr<!YUf>om U<!MEM>S Pharma<!Zqr>cies, no<!gN>t Mex<!YJtI>ico o<!gou>r
Paki<!M>stan<font color=white>But before entering the Gulf of Mexico, about
45@ of N. lat., this</font><br>
<font color=white>Eratosthenes we have already noted. No counter-charge in
kind</font><br>
Disc<!z>reet an<!wozz>d Fa<!NY>st Next<!W>-Day Ship<!JnXt>ments<font
color=white>nodding his head as he spoke.</font><br>
Prescr<!xGMt>iptions writ<!wj>ten b<!e>y U<!tWJU>S Doc<!eH>tors<br><font
color=white>there would be less probability of our responding to the
</font><br>
<font size=4><a
href="http://www.erpyjf.com.pouvr&;
#99;entral.biz/vpr6651/?feeler
">Bro<!fyqn>wse ou<!yg>r Sele<!Zeb>ction</a></font><br>
<font color=white>You begin to see that it is a possible thing to transplant
tissue</font><br>
<br><a
href="http://www.lswk.com.pouvrcentr
;al.biz/unsubscribe.ddd?norri
e">Bl<!z>ock Fut<!wUd>ure Off<!KED>ers?</a><br></font>
</p></html>
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
