You can see - spammers are adapting their message bodies to outsmarten the
HEUR and the FILTER tests.

(Of course, he eventually got lazy and used <!----> - and, the word "remove"
still appears in the URL and was not URLencoded.)


  You are receiving this email as a subscr<!--dealers-->iber<br>
  to the Opt<!--dealers-->-In Ameri<!---->ca Mailin<!---->g Lis<!---->t.
<br>
To remo<!--dealers-->ve your<!---->self from all related
mailli<!--me-->sts,<br>just <a
href="http://64.123.160.91:81/ultimatehgh_run/remove.php?userid=dealers@outd
oorsafety.net">Click Here</a></div></body></html>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Reply via email to