No, the font command is embedded specifically to cause pattern-matching junk mail scanners to miss the email. I am seeing messages like this:


<font color=#5D5AC3>Buy my wonderful prod<font color=#5D5AC3>uct it will do mira<font color=#5D5AC3>cles and make you younger while enlarg<font color=#5D5AC3>ing your proboscis and elimin<font color=#5D5AC3>ating wrinkles, while you make a million dollars sitting at ho<font color=#5D5AC3>me talking to wonderful Rus<font color=#5D5AC3>sian women just waiting to speak to you.


At 08:26 AM 2/4/2003, Bonno Bloksma wrote:

> Now that we have the Comments tag, I now find spam with tons of these
> peppered throughout:
>
> <font color=#5D5AC3>

Standard HTML stuff I think.

> Not really comments, as they are functional, but they're put randomly
> throughout the email. Functional, but pointless. Any ideas?

The whole idea behind the Comments tag was to flag e-mail that has been made
unique by inserting lots of comments which usually are identical in one
e-mail but different in between mails. That way they don't get caught by
pattern recognizers, however, Declude would catch them by simply counting
the number of comments, which *should* not be to high.

Let's leave the rest of the stuff alone, in my opion it would only burden
Declude with stuff it is not supposed to handle anyway. What would you do
with those mail that change the color, delete them, put them on hold?
Or...... do you think these color statments are used in the same way the
comment tags are being used, with several tags after one another and the
last having the correct color?

Met vriendelijke groet,

Bonno Bloksma

---
[This E-mail scanned for viruses by Declude Virus using f-prot]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
_______________________
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to