Hello, Razvan-san. I searched in my this ML's mailbox for finding "span float" spam, so I found your mail.
From: Razvan Cosma <[EMAIL PROTECTED]> Subject: Re: <something> one SPAM Date: Thu, 20 Apr 2006 15:48:20 +0300 > Hi, > > Michael Monnerie wrote: > > On Donnerstag, 20. April 2006 14:28 Razvan Cosma wrote: > > > >> Body formatting varies slightly, text remains the same. > >> > > > > Then write some body rules that catch the text. > > > > > I have no idea how to do that.. > what the user reads on the screen is > "Your credit doesn't matter to us !" > and the text seen after the HTML is parsed is something like: > "Your c v redi y t doew bsn't mat ter to us !" > with variations. The idea is that random characters are placed on the > right of the screen with <FONT style="float:right">, and this tag is > split on several lines. > Is there any way to define a multiline rule in spamassassin? The only way to match multiline rule is 'full' rule. But, 'full' is 'whole mail message' object. The object is NOT decoded, raw mail message. ex. full ___OBFUSCATING_FLOAT /<span style=\"border: 0px\; float\n: right\"> \w <\/span>/ The above rule can't match Quoted-Printable encoded message. So, I wrote below: rawbody ___OBFUSCATING_FLOAT0 /<span style=\"border: 0px\; float/ rawbody ___OBFUSCATING_FLOAT1 /^: right\"> \w <\/span>/ meta OBFUSCATING_FLOAT ___OBFUSCATING_FLOAT0 && ___OBFUSCATING_FLOAT1 describe OBFUSCATING_FLOAT <span style="border: 0px; float: right"> d </span> score OBFUSCATING_FLOAT 1.5 rawbody FLOATGEOCITIES /^<A href=\"http:\/\/geocities\.com\/\w+\/\">\w+<span style=\"border: 0px\; float/ describe FLOATGEOCITIES <A href="http://geocities.com/GabicRectohoate/";>V<span style="border: 0px; float score FLOATGEOCITIES 2.0 -- Nothing but a peace sign. MATSUDA Yoh-ichi(yoh) mailto:[EMAIL PROTECTED] http://www.flcl.org/~yoh/diary/ (only Japanese)
