Look for the thread about "Pharamcudical list of words in a table".
See: http://www.gossamer-threads.com/lists/spamassassin/users/59435?page=last
All these messages are probably coming from one evil source.
Some say it's a guy called Leo Kuvayev and he keeps chaning the messages and trying to fool SA.
You really should include SARE_OBFU and SARE_HTML (in http://www.rulesemporium.com/). I see that these rule files score some points on Leo's messages. But most of the points are from all the network checks.
I also added my own personal rule to increase the total score on these tables:
# This one adopted from sare_html:
rawbody IA_HTML_MANY_BR /<br>.{0,10}<br>.{0,10}<br>.{0,10}<br>.{0,10}<br>/i
describe IA_HTML_MANY_BR Tooo many close <br>'s!
score IA_HTML_MANY_BR 0.500
On 9/14/05, Brian Ipsen <[EMAIL PROTECTED]
> wrote:
Hi,
The number of messages like below has increased. Unfortunately, they are
not reported to SpamCop fast enough for SURBL to handle them.... Has anyone
created some sort of filter to identify this type of messages ??
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV> </DIV>
<DIV><A href="" to site</A></DIV>
<DIV> </DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier>Me<BR>Xa<BR>Ul<BR>Am<BR><STRONG>Ci</STRONG><BR>Le<BR><STRONG>Va
</STRONG><BR>Pr<BR><STRONG>Vi</STRONG><BR>Ce</FONT></DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier>ri<BR>na<BR>tr<BR>bi<BR><STRONG>al</STRONG><BR>vi<BR><STRONG>li
</STRONG><BR>op<BR><STRONG>ag</STRONG><BR>le</FONT></DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier>di<BR>x<BR>am<BR>en<BR><STRONG>is</STRONG><BR>tr<BR><STRONG>um<
/STRONG><BR>ec<BR><STRONG>ra</STRONG><BR>br</FONT></DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier>a<BR><BR><BR><BR> 1.<BR>a<BR> 3.<BR>ia<BR> 3.<BR
>ex</FONT></DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier><BR><BR><BR><BR>21<BR><BR>75<BR><BR>33<BR></FONT></DIV>
</BODY></HTML>
Regards,
/Brian
--
Ilan Aisic
Registered Linux User 8124 http://counter.li.org
