At Thu Jan 1 06:29:32 2004, Kenneth Porter wrote: > I'm attaching a sample of something that on first inspection looks like a > variant of the RND_UC_CHAR spam. The HTML part is different, but most > interesting is all the Bayes poison after the </HTML> tag in the HTML part. > This seems like it should be easy to check for. What rule would one use to > count the amount of material after </HTML>?
I'm glad you've posted this message -- I got one pretty much identical. However, what I noticed was the number of different ways the spammer spelled "Generic", "Super", "V-drug", "Cialis" to get past filters. The domain name -- wbegeds.com -- was the same too. > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> > <HTML><HEAD> > > <TITLE>Message</TITLE> > > <DEFANGED_META content="MSHTML 6.00.2800.1276" name=GENERATOR></HEAD> > <BODY> > <DIV><!-- Converted from text/plain format --><FONT face=Arial size=2> > <p>Hi,<br> > <br> > Genierc and Super Viarga (Caiils) available online!<br> > Most trusted online source!<br> > <br> > <br> > Cilais or (Spuer Vagira)<br> > takes affect right away & lasts 24-36 hours!<br> > <a href="http://www.wbegeds.com/c/index.php?AFF_ID=c1224";>FOR SUEPR VAIRGA CILCK > HERE</a><br> > <br> > <br> > Genierc Virgaa<br> > costs 60% less! save a lot of $.<br> > <a href="http://www.wbegeds.com/g/index.php?AFF_ID=v1224";>FOR VIGARA CILCK > HERE</a><br> > <br> > <br> > Both products shipped discretely to your door<br> > <br> > <br> > <br> > <br> > <br> > <br> > <br> > <br> > <br> > <br> > <a href="http://www.wbegeds.com/homepage/";>Not > intreseted</a><br></FONT></DIV></BODY></HTML> > fogy propitiate indispensable membrane finite daffodil incondensable fleshy juanita > azerbaijan heraclitus approximant fadeout knifelike conclusion homeland invisible > propyl eradicable chadwick doric crucial czech resistible caramel convair <br> > cobol glimpse repository camden coffer compressor simpleminded gastronome bulk > cutoff bantus axiomatic negotiate crimea positive maggoty dossier bohemia chime > boletus billow jittery lineage barrette defuse annex decedent <br> > criterion grata aden pascal senate ireland deprecatory hospice module brazilian face > crimea animadversion leery lentil hospitable analogous affluent gouda explore leona > improvisate equivocate annul <br> > drastic bid estella durance laconic olivine nonetheless eli combustion shameful > jeremiah aide dire cole buret hydrophobia recovery appraise caustic folksong > prejudicial manure casino patriotic inductee bashful epithelial crosstalk hydrangea > butchery earthmove cyclotomic <br> > rove reliant bombproof elmer degassing boundary downtrend chameleon athenian > comprehensive graze aloft republican careful cervantes chameleon severe berlin > controversial castigate roseland effluvium greater blunt elegy famish geochronology > epitaph consonant <br> > dutiful cowherd durable detention else cassette flood sentry cochrane emblazon > collard <br> > fe delirious corporeal grasp sedentary discovery incalculable perspective jackson > bandgap inexorable rowley ipso screwbean herb beer klein remark cozy arcadia bed > bailiff commissary caption hexafluoride hummock aroma bimonthly ecumenist canberra > forbid cooperate about commentary revolution gargle <br> > bali exclusive behest dane puck owe payne genuine doublet egan marital hilarious > roberts chimeric chalice redstart dopant dichotomy rachmaninoff hartford perth flirt > buttermilk bangor chorale fusillade bayonne <br> > hopkins gain dicta barr excursus glee loiter formulae glorious encumber burst > chivalrous cobble cater gratify dine gyroscope herodotus cell bluefish cress > diminutive discipline fisherman doubleday severe backlash <br> > pursuit monitory breakup isothermal gastrointestinal anarch dockside embouchure pogo > brilliant heigh banach antithetic patch attrition attainder hepburn crucify garry > fringe pulpit convene contrabass gnat deliquesce crime compendia evocable experiment > eclogue desirous faber bonanza showplace exigent clipboard crosby durable hattie <br> Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
