Re: Explosion in uk.geocities.com spam

[Patrick von der Hagen]

Kenneth Porter schrieb:
Lately I've been seeing quite a bit of uncaught spam with a link to 
uk.geocities.com.  Using 3.1.0 release with net tests. Here's my 
Same here, so I decided to add some points to uk.geocities.com-URLs. I'm 
assigning high scores if such a link is on a line by itself and low 
scores otherwise. Not really happy, tough.

Harder to catch are some spams which start with some greeting, thin give 
a short table of drugs (the V-one, the C-one,etc.) and politely say goodbye.

They use html and tables very smart, thus avoiding Bayes rules. 
Basically it is an invisible tables, using one row and several columns. 
The first column contains the first letter of every line, separated by 
"<BR>" and optionally some style-tags (b, i, etc.). Next column contains 
several more characters for each line, etc.

Bayes and text-matching currently is quite useless and DNS-Blacklists or 
SURBL hit rarely. I'm quite lost....
--
CU,
   Patrick.