You just missed a discussion about a custom rule. If you are not familiar with custom rules, I suggest some reading and examples:
http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm http://www.exit0.us/ http://www.emtinc.net/spamhammers.htm Now, ian douglas improved a set I was using: > -----Original Message----- > From: ian douglas > Sent: Wednesday, November 19, 2003 2:19 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] <font color="#FFFFFF"> > > > > describe MY_RBDY_INVSTXT MY: Invisible text color > > rawbody MY_RBDY_INVSTXT /<font\s?.* > > color=("?\#?FFFFF[0-9A-F]"?|"?white"?).*>/i > > score MY_RBDY_INVSTXT 2.0 > > > Just my $0.02, but I'd make it this: > > color=("?\#?F[0-9A-F]F[0-9A-F]F[0-9A-F]"?|"?white" > > > .. spammers will use more than just the last byte of the > color to make something a shade of "white". > > Your rule would catch > #FFFFFE > etc > > but not > > #FEFFFF > > or > > #FFFEFF > > ... which will appear just as 'white'. > > -id You will need to note that the rawbody line needs to be one line without any line breaks. So the test portion would look like: /<font\s?.*color=("?\#?F[0-9A-F]F[0-9A-F]F[0-9A-F]"?|"?white"?).*>/i --Larry > -----Original Message----- > From: Robert Oslin [mailto:[EMAIL PROTECTED] > Sent: Wednesday, November 19, 2003 3:25 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] (no subject) > > > My first post to this list. Hope I'm doing this right... > > I received a message with invisible fonts, yet the generic > HTML_FONT_INVISIBLE rule wasn't hit. > > Was it because the body tag didn't specify a background font, > therefore the > text font color had nothing to compare against? > > Copy of the spam below: > <html> > <body><font color="#ffffff">exhaled <font > color="#ffffff">crowberry <font > color="#ffffff">potentiometer <font color="#ffffff">tavern <font > color="#ffffff">acidities <font color="#ffffff">evangel <font > color="#ffffff">crossbars <font color="#ffffff">merchants <font > color="#ffffff">hyperbolic <font color="#ffffff">mildly <font > color="#ffffff">exhibiting <font color="#ffffff">horde <font > color="#ffffff">housekeeper <font color="#ffffff">scorers <font > color="#ffffff">illustration <font color="#ffffff">scattered <font > color="#ffffff">methodicalness borates creating mate meadows meteoric > tenants excursion blueprint bong tamely<p> > <a > href="http://srd.yahoo.com/drst/councillors/*http://www.8u7hb. > com/in/"> > <img border="0" > > src="http://srd.yahoo.com/drst/scrawny/*http://www.addhr4.com/ > picnic.jpg" > > </a> > </p><font color="#ffffff">ponder <font color="#ffffff">evict <font > color="#ffffff">scrotum <font color="#ffffff">bette <font > color="#ffffff">acquirable <font color="#ffffff">scorched <font > color="#ffffff">idling <font color="#ffffff">scimitar <font > color="#ffffff">bow <font color="#ffffff">brat <font > color="#ffffff">terse > <font color="#ffffff">menu <font color="#ffffff">course hut admissions > addict brace polopony playwrights excommunicate expecting bocklogged > secondary</body> > </html> > > Here is what was hit: > > tests=FVGT_u_HAS_2LETTERFLDR,HTML_60_70,HTML_IMAGE_ONLY_06,HTM > L_MESSAGE,MIME > _HTML_ONLY,SMTPD_IN_RCVD > > Robert Oslin > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > Michael H. Collins > Sent: Wednesday, November 19, 2003 12:43 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] (no subject) > > > No, You leave... > > Is this spam of some new form? > > Reo wrote: > > leave > > -- > Michael H. Collins Admiral, Penguinista Navy > > It's us against them. Ride like you stole it! > http://linuxlink.com ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
