On 16 Dec 2020, at 23:21, Loren Wilton <lwil...@earthlink.net> wrote:
I just got a batch of spams containing
<span style="display:none">
Such rules are there. Unfortunately, for whatever reason, lots of ham
uses "invisible" text so it's not useful as a spam sign by itself and
it's hard to come up with any useful combination rules.
I think I may have figured it out - tracking images. Like:
<img src="long unique tracking uri" width="0" height="0" border="0"
style="visibility: hidden !important; display:none !important; max-height:
0; width: 0; line-height: 0; mso-hide: all;">
Note in your example the display:none is in a contained tag and not in an
opening tag of a span. The tag is probably fairly long because the URL is
probably huge, but it is still the one item that is hidden.
I put in a local rawbody rule for
m'<span style="display:none">.{100,}(?:$|</span>)'is
and so far I haven't gotten any hits on ham.
Of course that is a pretty heavy rule, but it would seem to indicate that
hidden spans may not be that common in ham.
