val:html_test('font_face_caps')
describe HTML_FONT_FACE_CAPSHTML font face has excess capital characters
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of alan
premselaar
Sent: Tuesday, May 10, 2005 8:08 AM
To: mimedefang@lists.roaringpenguin.com
Su
On 5/10/2005 12:31, Martin Blapp wrote:
> We use a specific ruleset against those 'ASCII artists', the
>
> rawbody __SMALL_FONT/font-size:[\s\t
> ]{1,3}(?:1|2)(?:px|pt|;)/i
Looks quite good :)
> We also look for different gaps between chars
I'm interested if things like sou
http://antispam.imp.ch/rules/asciispam.cf
The mails matching are all ASCII art mails:
May 10 16:55:21 mx2 sm-mta[20827]: j4AEsmeP020827: Milter add: header:
X-Spam-Status: Yes, hits=60.425 required=5 scantime="10.0960 seconds" tests=ASCII_GAPS_5,BAYES_50,\n\tDATE_IN_FUTURE_12_24,HTML_MESSAGE,MIME_
Hi,
our Bayes data! It seems that the ASCII artists don't
always change the strings they use for their "art", so things
like "rvwndsho" and "xpoebbcr" started to become statistically
significant in our Bayes data.
We use a specific ruleset against those 'ASCII artists', the
rawbody __SMALL
> No, but I have seen 2.5 points before. :) Silly question, where would
i
> put a new rule like that? I'm already changing some scores in
> /etc/mail/mimedefang/sa-mimedefang.cf, but not sure where to add a new
> rule.
Just paste it into your sa-mimedefang.cf file as below. I have two rules
a
-ray wrote:
[snip]
No, but I have seen 2.5 points before. :) Silly question, where would i
put a new rule like that? I'm already changing some scores in
/etc/mail/mimedefang/sa-mimedefang.cf, but not sure where to add a new
rule.
ray
Ray,
you should be able to create a file in /etc/mail/spam
On Tue, 10 May 2005, Joseph Brennan wrote:
We have been using
rawbody CU_TINY_FONT /font-size: (0|1);/i
describe CU_TINY_FONT HTML obfuscation using 0 or 1 pt lettering
It matches only about 1500 spams a day, but that's something. Yours
looks slightly better. Have you really se
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:mimedefang-
> [EMAIL PROTECTED] On Behalf Of Jonathan Maliepaard
> Sent: Tuesday, May 10, 2005 10:36 AM
> To: mimedefang@lists.roaringpenguin.com
> Subject: RE: [Mimedefang] Tiny Text
>
> This is the
This is the best I have seen so far
(open attached with a web browser)
2px. Quite clever really.
Jon.
From: dario vanlith [EMAIL PROTECTED]Sent:
09 May 2005 07:44 PMTo: Robby Crosdale; [EMAIL PROTECTED];
[EMAIL PROTECTED]Subject: For your convenience, select our
chemist-site for bes
Jonathan Maliepaard wrote:
> This is the best I have seen so far
> (open attached with a web browser)
[Tiny text making a picture of drug names]
I've seen a few of these. The first few got caught by SURBL,
and (unbelievably) some of them started getting caught by
our Bayes data! It seems
Maybe something like?
describe TINY_TEXT_1 Body includes very small html text
rawbody TINY_TEXT_1/FONT-SIZE: (?:1|1.5|2|2.5|3)px/i
score TINY_TEXT_1 3.0
#
describe TINY_TEXT_2 Body includes very small html text
rawbody TINY_TEXT_2
Hi
I received an email containing 1pt text (all very clever) and it came
right through our Can-It scanner. The random letters spelled out various
drugnames.
Is it safe enough to create a rule that looks at a raw body and scores
mail containing say fonts between 1 and 3 pixels?
Maybe something
12 matches
Mail list logo
