[Declude.JunkMail] Feature request: no displayable text in body

Matthew Bramble Fri, 05 Sep 2003 16:01:19 -0700

This seems to be the wave of the future in spamming. There's a lot of spam coming in with no text, just other HTML, mainly to display an image and get by heuristics. Most of this stuff gets caught by the various lists, but I get a couple a day to addresses pointed at my own account that hardly fail a thing if anything at all.

I'm aware of the BODY 0 ISBLANK filter, but this is a different situation since there is HTML code in the message. In order to distinguish this type of E-mail from an individual sending a picture to a friend you would want to verify that there was an attachment of that picture by either looking at the link or for the attachment. I believe such a test would have near 100% accuracy in catching spam, and a type of spam that is becoming more common, though maybe it's just a fad until the heuristics make this method less desirable (they probably already have).

This could be implemented as a filter like ISBLANK, or as marquee test like BASE64. You could call the test NOTEXT and use it to for the same as the BODY 0 ISBLANK functionality.

Here's a sample of a complete message:

From - Fri Sep 05 16:44:59 2003

Subject: 
=?iso-8859-1?b?SW5jcmVhc2UgZXJlY3Rpb24gcXVhbGl0eSBhbmQgZHVyYXRpb24gKEJFVFRFUiB0aGFuIFZpYWdyYSk=?=
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
To: [EMAIL PROTECTED]
Date: Fri, 05 Sep 2003 16:40:01 +0000
From: "Gwen L. Higgins" <[EMAIL PROTECTED]>
Content-Type: text/html
Content-Transfer-Encoding: 8bit
X-Declude-Sender: [EMAIL PROTECTED] [24.131.161.56]
X-Note: This E-mail was scanned by iGaia Incorporated's E-mail service (www.igaia.com) 
for spam.
X-Note: This E-mail was sent from h00e01841c8ef.ne.client2.attbi.com ([24.131.161.56]).
X-Spam-Tests-Failed: NOABUSE, IPNOTINMX, NOLEGITCONTENT [1]
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 314612838

<html><body>
<center><!--kpz4j815n29--><a href="http://www.wholesale22.com/host/default.asp?ID=omni";><img 
src="http://discountrate2.com/pics/gv1.gif"; height="270" width="405"></a></center>
</html></body>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Feature request: no displayable text in body

Reply via email to