On 06 Dec 2003 17:21:54 -0600, Scott A Crosby <[EMAIL PROTECTED]> posted to spamassassin-talk: > On Sat, 6 Dec 2003 22:04:15 +0000 (GMT), Martin Radford > <[EMAIL PROTECTED]> writes: >> I don't know how new this trick is, but I've not seen it before -- the >> spammer is using HTML tables to break up the message content. Also, >> most of the interesting words are mis-spelled. It does at least hit >> on HG_HORMONE. > Cute! > I'd say let bayes deal with it. One of the purposes of bayes is to > make sure that this sort of mangling can only happen once.
It would be good to have a rule to match the general pattern. It's probably too much work to generate that sort of email by hand so chances are you can find a unique pattern if you collect a few messages which have this obfuscation. This has been going around for at least a year; it's reported in the Spammers' Compendium <http://www.jgc.org/tsc/> as of Jan 17, 2003 (it's the "Slice and Dice" pattern). One thing to go by might be the silliness of using HTML to send monospaced text. I mean, what's the point of that (unless you actually +want+ your ad to be ugly [1])? The example Martin posted is in Arial, though, and looks quite different from the old example on the TSC site. /* era */ [1] Some of the ad posters you see on town these days would seem to confirm that this is a prevalent advertising trend ... -- The email address era the contact information Just for kicks, imagine at iki dot fi is heavily link on my home page at what it's like to get spam filtered. If you <http://www.iki.fi/era/> 500 pieces of spam for want to reach me, see instead. each wanted message. ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
