Thanks Jennifer! I should have know you would be on top of this.
--Larry
> -----Original Message-----
> From: Jennifer Wheeler
> Sent: Wednesday, October 29, 2003 11:11 AM
> To: 'Larry Gilson'; 'Mark Ritchie';
> [EMAIL PROTECTED]
> Subject: RE: [SAtalk] Exessive HTML Code
>
>
>
>
> > Yes, this would be possible.
> >
> > describe MY_RBDY_EXSV_TAG MY: Excessive HTML Tags
> > rawbody MY_RBDY_EXSV_TAG /<[bi]><\/[bi]>/i
> > score MY_RBDY_EXSV_TAG 4.0
> >
> > Backhair did not hit because the number of characters within the
> > tag isfewer than 6. Creating rules to match fewer than 6
> > characters within the tag delimiters creates false positives. You
> > will most certainly need to score it how you want rather than the
> > arbitrary number I supplied.
> >
> > --Larry
>
> I've been using similar rules without havoc. The font/font
> could be much better, I was just lazy and wrote it just for
> the spam I had and haven't gotten around to tweaking that
> one. You could include some more, I just threw these in.
>
> rawbody J_HTML_FNTFNT /<font color\=\#.{0,6}><\/font>/i
> score J_HTML_FNTFNT 1.0
>
> rawbody J_HTML_I_I /<i><\/i>/i
> score J_HTML_I_I 1.0
>
> rawbody J_HTML_B_B /<b><\/b>/i
> score J_HTML_B_B 1.0
>
> rawbody J_HTML_LI_LI /<li><\/li>/i
> score J_HTML_LI_LI 1.0
>
> rawbody J_HTML_UL_UL /<ul><\/ul>/i
> score J_HTML_UL_UL 1.0
>
> rawbody J_HTML_U_U /<u><\/u>/i
> score J_HTML_U_U 1.0
>
> But this was for obfuscating <b></b>phrases rather than
> words. I did several so I wouldn't have to score them as
> high. They wouldn't do diddly for the score in Mark's
> example, that's the first I've seen those tags as 'popcorn'
> in the source. I figured it was coming based on the other
> little evasive things they're doing. (many unsuccessful) The
> key is keep doing secret tweaks to your P&B as they change
> their style, mustn't show all your cards. ;) but a tweak on
> P&B wouldn't be practical in this case. (in my inexperienced
> opinion) Perhaps it's time for a new set. That would be an
> easy technique to stop them from using lest they get tagged.
> When I get some time, I'll play around.
>
> Jennifer
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
