Re: How to stop HTML Porn emails?

[Andy Jezierski]

Steve Dimoff <[EMAIL PROTECTED]> wrote on 03/31/2004 12:29:18 PM:

> We keep getting these emails in.... and everyday the URL changes, so
> even if I create a rule to look for this, the next day or even a
> couple hours, it's something new.
>  
> Does anyone have a rule set that will work for checking stuff like
> this? Or do I just need to turn up the HTML /BIZ top level domain?
>  
> Thanks,
> Steve
>  
>  
[snip]

Scored a 12.3 on my system.  Wonder why mine didn't hit on the BigEvil list??? Just downloaded the new one this morning.  Oh well, it scored high enough without it.  Probably would have scored even higher if the message headers were in the message.

X-Spam-Report:
        *  0.7 RM_tl_ToNone To header not found
        *  0.3 RATWR7a_MESSID Message-ID has ratware pattern (12hex$8hex$8hex@)
        *  2.0 FROM_NO_LOWER 'From' has no lower-case characters
        *  0.6 FVGT_s_SINGLE_LETTER FVGT - Single non-vowel seperated by spaces
        *  0.1 OACYS_SINGLE BODY: A single consonant surrounded by whitespace, minus some of the obvious FP's
        *  2.1 BAYES_90 BODY: Bayesian spam probability is 90 to 99%
        *      [score: 0.9735]
        *  0.3 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
        *  1.6 HEADER_COUNT_CTYPE Multiple Content-Type headers found
        *  1.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
        *  1.1 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
        *  1.3 BODY_EMPTY BODY_EMPTY
        *  1.2 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag


Andy