Just an observation.. It seems like the Comments test is not being triggered as often as I see it used..
FAQ. :)
I thought you stated a while back that the comments test now picks up any attempt to break words.. E.g.
No -- it just isn't possible.
The COMMENTS test detects anti-filter comments (which consist of any HTML comments <!-- comment -->, which also break up words (to help ensure that legitimate comments, as silly as they may be in E-mail, to cause the test to fail).
However, shortly after the COMMENTS test was added, spammers realized there was no need to use HTML comments to do the same thing. So what they are doing is making up HTML tags, and using text such as "spa<blah>mmer" (which shows up as "spammer" in a mail client).
The problem is that it is nearly impossible to determine which are valid HTML tags and which are not -- that would require a database of known good HTML tags, which would need to be constantly updated.
What we *did* do, though, it set up Declude JunkMail so that filters will work with these (so a Declude JunkMail filter will see "spammer" in the above example). While that doesn't let Declude JunkMail detect the spamming technique, it does negate any benefit that the spammer would see from using it.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
