A spam I received yesterday had these comments in it also. However one thing I noticed was that the spam had a url that started off with the standard http then was followed by PercentHexHexPercentHexHexPercentHexHexPercentHexHexPercentHexHex and so on.
This should be very easy to filter on as no legit mailer should be hiding urls like that. Mike ----- Original Message ----- From: "Madscientist" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, November 19, 2002 8:47 PM Subject: RE: [Declude.JunkMail] Wordfilter bypassed > | > | However, that's the way spam control is heading. As more and > | more people > | get fed up with spam, more and more of the bozos that are > | doing things the > | wrong way will need to fix their problems. > | > | I can understand an HTML E-mail having one or two comments in > | it, but 10 or > | 20 is just a waste of bandwidth. That is information the > | recipient will > | never see. > | > | -Scott > > Where we got into trouble was with big corporate iron... (IBM, Sun, > Microsoft, etc...) The comments in those messages were part of the code > base generating the messages and I can imagine (as a web developer also) > that they are pretty vital to the developers in their ongoing > maintenance efforts. It's not uncommon to see quite a few of them. As we > increased the threshold to accommodate the legitimate messages we were > capturing we soon reached a level where legitimate and non-legitimate > were practically indistinguishable. All I'm saying here is that since > HTML email is here to stay, and HTML comments are legitimate and > sometimes required for coding standards, a simple count of HTML comments > will not be a valid spam test in most cases. This has been our > experience - your mileage may/will vary. > > _M > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
