set the rule to look for <!--*<!--*<!-- Eric S ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 18, 2003 11:10 AM Subject: Re: [IMail Forum] IMail rule to count number of occurances
> > >I was wondering if anyone know of a way to create a rule that would > >forward a message to my spam mailbox if it contained 3 or more occurrences > >of <!-- . I have several rules set up and they are working great, but my > >problem is now the spammers are inserting HTML comments in the middle of > >the words, thus the message makes its way through my rules. > > I don't believe that IMail rules can do what you want there. > > However, we have done extensive research on comments in HTML, and I'm not > sure that such a rule would be a good idea. We have found that lots of > legitimate E-mail (typically HTML newsletters) will have a lot of comments > in them. In Declude JunkMail, we get around that by checking for > "anti-filter" comments (ones that are designed to bypass filters, such as > "sp<!--comment-->am", as opposed to normal filters such as > "<!--comment-->spam"). > > Worse, though, spammers are now using made-up HTML tags to do this -- such > as "sp<blah>am", or using real tags, such as "sp<b></b>am". That's much > more sinister (however, we've set up the filters in Declude JunkMail so > that it will look at the text that the user should see, so these would get > caught if you were filtering for the word "spam"). > > We find that almost 10% of spam has anti-filter comments in them, and > another 10% or so uses base64 encoding to get around standard > filters. That's bad news for people who just use filters, but good news > for anti-spam programs (since it is extremely rare for legitimate E-mail to > have anti-filter comments or base64 encoding of text/HTML segments). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
