Re: [Declude.JunkMail] HTML-Test?
What about a JavaScript test? There's something that should not be in non-spam email. Or an ActiveX control detection. Both of these are big clues that it is spam. -Josh -- Joshua Levitsky, MCSE, CISSP, EMTD Desktop Systems Engineer AOL Time Warner - Original Message - From: Mark Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 12, 2002 8:39 AM Subject: RE: [Declude.JunkMail] HTML-Test? Not to mention that all iMail Web mail is HTML. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, June 12, 2002 8:34 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HTML-Test? I'm currently implementing Junkmail. My question: Is there a test if the mail is in HTML or in TEXT-Format? When I check the spam-mails recieved in the past days over 90% of this mails are HTML-formated. So I think HTML-formated mails should recieve 2-3 points in the weighting system. Any suggestions, arguments, info's...? The problem with this is that most personal E-mail is sent in HTML (you can give a BIG thanks to Microsoft for that one). I believe that the default settings in Outlook will send both text and HTML, even if there is no difference between the text and HTML segments (so even though the E-mail appears to be a plain text E-mail, it has an HTML copy of it). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] HTML-Test?
What about a JavaScript test? There's something that should not be in non-spam email. Or an ActiveX control detection. Both of these are big clues that it is spam. This is something that we are considering testing for (along with base64 encoding of text or HTML segments, which is normally only used to try to bypass content-based scanning). Declude Virus Pro already looks for some of that, in determining whether or not HTML code may be dangerous. So it may not be too difficult to implement. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] HTML-Test?
Unfortunately this leads to a high false positive rate. (We tried it and pulled it.) _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of | Joshua Levitsky | Sent: Thursday, June 13, 2002 2:11 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] HTML-Test? | | | What about a JavaScript test? There's something that should | not be in non-spam email. Or an ActiveX control detection. | Both of these are big clues that it is spam. | | -Josh | | -- | Joshua Levitsky, MCSE, CISSP, EMTD | Desktop Systems Engineer | AOL Time Warner | | | - Original Message - | From: Mark Smith [EMAIL PROTECTED] | To: [EMAIL PROTECTED] | Sent: Wednesday, June 12, 2002 8:39 AM | Subject: RE: [Declude.JunkMail] HTML-Test? | | | Not to mention that all iMail Web mail is HTML. :) | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott | Perry | Sent: Wednesday, June 12, 2002 8:34 AM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] HTML-Test? | | | | I'm currently implementing Junkmail. | My question: Is there a test if the mail is in HTML or in | TEXT-Format? | | When I check the spam-mails recieved in the past days over | 90% of this | mails are HTML-formated. So I think HTML-formated mails | should recieve | 2-3 points in the weighting system. | | Any suggestions, arguments, info's...? | | The problem with this is that most personal E-mail is | sent in HTML | (you can give a BIG thanks to Microsoft for that one). I believe | that the default | settings in Outlook will send both text and HTML, even if | there is no | difference between the text and HTML segments (so even though | the E-mail | appears to be a plain text E-mail, it has an HTML copy of it). | -Scott | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | | This E-mail came from the | Declude.JunkMail mailing list. To unsubscribe, just send | an E-mail | to [EMAIL PROTECTED], and type unsubscribe | Declude.JunkMail. | You can E-mail [EMAIL PROTECTED] for assistance. You | can visit | our web site at http://www.declude.com . | | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. You can E-mail | [EMAIL PROTECTED] | for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] HTML-Test?
Not to mention that all iMail Web mail is HTML. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, June 12, 2002 8:34 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HTML-Test? I'm currently implementing Junkmail. My question: Is there a test if the mail is in HTML or in TEXT-Format? When I check the spam-mails recieved in the past days over 90% of this mails are HTML-formated. So I think HTML-formated mails should recieve 2-3 points in the weighting system. Any suggestions, arguments, info's...? The problem with this is that most personal E-mail is sent in HTML (you can give a BIG thanks to Microsoft for that one). I believe that the default settings in Outlook will send both text and HTML, even if there is no difference between the text and HTML segments (so even though the E-mail appears to be a plain text E-mail, it has an HTML copy of it). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
