I was wondering if anyone know of a way to create a rule that would forward a message to my spam mailbox if it contained 3 or more occurrences of <!-- . I have several rules set up and they are working great, but my problem is now the spammers are inserting HTML comments in the middle of the words, thus the message makes its way through my rules.
I don't believe that IMail rules can do what you want there.
However, we have done extensive research on comments in HTML, and I'm not sure that such a rule would be a good idea. We have found that lots of legitimate E-mail (typically HTML newsletters) will have a lot of comments in them. In Declude JunkMail, we get around that by checking for "anti-filter" comments (ones that are designed to bypass filters, such as "sp<!--comment-->am", as opposed to normal filters such as "<!--comment-->spam").
Worse, though, spammers are now using made-up HTML tags to do this -- such as "sp<blah>am", or using real tags, such as "sp<b></b>am". That's much more sinister (however, we've set up the filters in Declude JunkMail so that it will look at the text that the user should see, so these would get caught if you were filtering for the word "spam").
We find that almost 10% of spam has anti-filter comments in them, and another 10% or so uses base64 encoding to get around standard filters. That's bad news for people who just use filters, but good news for anti-spam programs (since it is extremely rare for legitimate E-mail to have anti-filter comments or base64 encoding of text/HTML segments).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
