>...
>Hi,
>
>Recently a lot of messages have started getting past spamassassin as
>ham. They are all the same format and disguise the words by using
>floating divs:
>
><DIV style="FLOAT: left;">
>C<BR>P<BR>L<BR>U<BR>C<BR>M<BR>X<BR>V<BR>A<BR>V</DIV>
>
><DIV style="FLOAT: left;">
>e<BR>r<BR>e<BR>l<BR>I<BR>e<BR>a<BR>A<BR>m<BR>I</DIV>
>
>Is there a ruleset that would catch e-mails of this type? Ie a test for
>lots of divs that have been floated left and contain lots of breaks?
>
>An example of such a message is here:
>
>http://www.nickgilbert.com/temp/spam.txt
>
>Thanks,
>
>Nick...
>
Another day with a bunch of Kurayev spams. This one references a
domain, amyslate.com-munged, which has already been deleted. You can see
the original registration (from a few days ago) at RFCI.
The earlier notoriousbadboys.com-munged was Leo also (with some
new name servers, for those who like to follow him).
Paul Shupak
[EMAIL PROTECTED]
