Re: More undetected hidden test spam signs

2020-12-22 Thread Loren Wilton
Right, but __STY_INVIS is currently tag-blind (it only looks for the style="" clause), so it hits that, and if lots of ham is hiding tracking images that way that might explain the poor S/O. I suspect that might be the case. The vast majority of invisible garbage I see is hidden in a ...

Re: More undetected hidden test spam signs

2020-12-22 Thread John Hardin
On Tue, 22 Dec 2020, Loren Wilton wrote: On 16 Dec 2020, at 23:21, Loren Wilton wrote: I just got a batch of spams containing Such rules are there. Unfortunately, for whatever reason, lots of ham uses "invisible" text so it's not useful as a spam sign by itself and it's hard to come up

Re: More undetected hidden test spam signs

2020-12-22 Thread Loren Wilton
On 16 Dec 2020, at 23:21, Loren Wilton wrote: I just got a batch of spams containing Such rules are there. Unfortunately, for whatever reason, lots of ham uses "invisible" text so it's not useful as a spam sign by itself and it's hard to come up with any useful combination rules. I

Re: More undetected hidden test spam signs

2020-12-22 Thread John Hardin
On Thu, 17 Dec 2020, John Hardin wrote: On Thu, 17 Dec 2020, @lbutlr wrote: On 16 Dec 2020, at 23:21, Loren Wilton wrote: I just got a batch of spams containing Interesting. I remember in the early days of html spam there were various rules to tag messages as spam when they had content

Re: More undetected hidden test spam signs

2020-12-18 Thread RW
On Thu, 17 Dec 2020 08:58:07 -0800 (PST) John Hardin wrote: > On Thu, 17 Dec 2020, @lbutlr wrote: > > > On 16 Dec 2020, at 23:21, Loren Wilton > > wrote: > >> I just got a batch of spams containing > >> > >> > > > > ... various rules to tag messages as spam when they had content that > >

Re: More undetected hidden test spam signs

2020-12-18 Thread @lbutlr
On 17 Dec 2020, at 09:58, John Hardin wrote: > Such rules are there. Unfortunately, for whatever reason, lots of ham uses > "invisible" text so it's not useful as a spam sign by itself and it's hard to > come up with any useful combination rules. In the "Archive" folder on my work email there

Re: More undetected hidden test spam signs

2020-12-17 Thread John Hardin
On Thu, 17 Dec 2020, @lbutlr wrote: On 16 Dec 2020, at 23:21, Loren Wilton wrote: I just got a batch of spams containing Interesting. I remember in the early days of html spam there were various rules to tag messages as spam when they had content that did not display. (Possibly

Re: More undetected hidden test spam signs

2020-12-17 Thread RW
On Wed, 16 Dec 2020 22:21:12 -0800 Loren Wilton wrote: > I just got a batch of spams containing > > > > That was followed by about 2K bytes of garbage containing GUIDs and > links to putatively some youtube video. The span was then terminated > correctly, the body of the spam, and then the

Re: More undetected hidden test spam signs

2020-12-17 Thread @lbutlr
On 16 Dec 2020, at 23:21, Loren Wilton wrote: > I just got a batch of spams containing > > Interesting. I remember in the early days of html spam there were various rules to tag messages as spam when they had content that did not display. (Possibly pre-SpamAssasin or at least pre my use of