At 7:20 PM -0700 06/15/2013, John Hardin wrote:
I took a closer look at this and it seems they're working around
trivial gibberish detection by putting a valid CSS property at the
very beginning of the style tag.
Revising the rules...
I am now seeing STYLE_GIBBERISH hitting on a lot of spam in the past
day or so, since the new rules hit the distribution. So far, all
TPs, no FPs.
Would you be willing to create an HTML_COMMENT_GIBBERISH rule, which
would be very similar to this one, but which looks for long strings
of gibberish instead HTML comments? (That is, <!-- gibberish -->).
A number of FN spams that leak through are using gibberish comments
without gibberish styles. I would imagine detecting this should be
quite similar to detecting style gibberish...
I could provide one or more examples if you need.
Thanks in advance. =)
--- Amir
