On Wed, 28 May 2003, Ron Clarke wrote: > > I wonder whether this one will get through your Spamassissin... probably > > my miss-spelling will confuse it enough <G> > > I don't know if anyone else is getting them, but I have been receiving > a lot of spam that comes as HTM only (so I dont open it with Arachne, of > course), but that html is constructed with garbage letters surrounded by > hide tags "< ! - - xyxyxyx - - >" to break up the words that might > trigger spam filters. > > Sneaky bastards !
I've added a rule for that to SpamAssassin. rawbody HTML_COMMENT_INTERUPTUS /<!=/ describe attempt to make words unrecognizable ( rawbody form is usually <!=3D ) ... and then the score score HTML_COMMENT_INTERUPTUS 3.0 Since HTML-only emails already get 3 points, the INTERUPTUS rule positively assures the e-mail will go the spamfolder at least, and if there are two more points from any other attribute, it'll go straight to /dev/null. -- Steve Ackman http://twoloonscoffee.com (Need green beans?) http://twovoyagers.com (glass, linux & other stuff)
