(I haven't been reading this list or upgraded recently, so maybe this has
been done. If so, apologies)

I just noticed 3 spams come through:

  <a href="http://spam.org/buy.html>
    <img src=http://spam.org/buy.jpg></a>
  plotters screechy idiom  etc. (14 lines)
  <a href="http://spam.org/thanks>
    <img src=http://spam.org/thanks.gif></a>

and

  <a href="http://spam.org/buy.html>
    <img src=http://spam.org/buy.jpg></a>
  schoolteacher adirondack terbium etc. (14 lines)
  <a href="http://spam.org/thanks>
    <img src=http://spam.org/thanks.gif></a>

I.e. the body was totally different, with different e1,2,3,4 signatures,
but the same links

I seem to be getting more of these getting past SpamAssassin + Razor -
there is not enough body to trigger alarms and no repeatable text.

A suggestion: generate a checksum of just the link URLs, image URLs and
perhaps the link text.




-- 
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376
[EMAIL PROTECTED]


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Razor-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/razor-users

Reply via email to