My first post to this list. Hope I'm doing this right...
I received a message with invisible fonts, yet the generic HTML_FONT_INVISIBLE rule wasn't hit.
Was it because the body tag didn't specify a background font, therefore the text font color had nothing to compare against?
For what it's worth, I've been using this rule grouping against this particular spam generator. I picked up on the fact that it has a billion font tags, but never closes any of them. It's been in place since 11/7 and so far, no FPs on anything other than discussions of spam.
This rule should (theoretically) work in any version of SA 2.40 and higher, I'm using in on 2.60.
rawbody __LOCAL_FONT_COLOR /\<font color\=/i
rawbody __LOCAL_FONT_TERM /\<\/font\>/i
meta LOCAL_HTML_FONT_NOTERM (__LOCAL_FONT_COLOR && !__LOCAL_FONT_TERM )
describe LOCAL_HTML_FONT_NOTERM has an HTML font color tag with no font tag terminators
score LOCAL_HTML_FONT_NOTERM 1.0
Of course, this spammer can easily change to evade this rule, but for the moment it works to boost their score a bit.. some of these emails are effective at abusing bayes because of the bad HTML formatting.
------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
