RE: [Declude.JunkMail] More more !--UserID--
Title: Nachricht Hi Kami SpamChk takes care of this. There is a parameter "FakedHTMLComments" that searches for repeated html-comments like !--xyz-- where "xyz" is even the same. This should not trigger html-comments in certain newsletters. Additional SpamChk removes all HTML-Tags before the Keyword-search begin. Markus -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kami RazvanSent: Thursday, January 16, 2003 10:58 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] More more !--UserID-- Hi; There has to be something that can be done about detecting this... == Prev!--info--ent Prema!--info--ture Agin!--info--!--info--g and DiseasebrB!--info--uild Lea!--info--ner Mus!--info--cle Mas!--info--sbrRe!--info--duce Bo!--info--dy Fa!--info--t and St!--info--res!--info--sbrIn!--info--crease Ener!--info--gy Le!--info--vels and Se!--info--xual St!--info--aminabr == This is becoming almost a regular occurance and more more spammers are doing this. As if a software is recently introduced that does this and now everyone is buying it. No longer filters can work on this except if we start filters that are set for every UserID in the system with the html comment brackets around it. Regards, Kami
RE: [Declude.JunkMail] More more !--UserID--
SpamChk takes care of this. There is a parameter FakedHTMLComments that searches for repeated html-comments like !--xyz-- where xyz is even the same. This should not trigger html-comments in certain newsletters. Caught this late, what is SpamChk...? Additional SpamChk removes all HTML-Tags before the Keyword-search begin. I would think a simple stripping of all HTML comments from mail before JunkMail processing would take care of this. Is this something that has been considered? I realize the load it may make on heavier traffic systems. BTW, thanks Scott for Declude products. Just filled out the credit card for another year's service agreement. So far, had only one occasion to email for support, but you're worth the money. Besides, our budget got lopped for all kinds of other stuff, if we don't spend what we *do* have allocated we won't get it next year... :) Jeff --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More more !--UserID--
I would think a simple stripping of all HTML comments from mail before JunkMail processing would take care of this. Is this something that has been considered? I realize the load it may make on heavier traffic systems. It has been considered, but like other similar ideas (such as decoding base64 MIME segments and filtering using wildcards), it could use up a lot of CPU time if not handled carefully. Something that we are also considering is a test that checks for more than X HTML comments in an E-mail (preferably just counting ones in the middle of words, such as unsub!-- user --scribe, rather than to !-- user -- unsubscribe, as the former prevents filtering whereas the latter does not). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More more !--UserID--
]Something that we are also considering is a test that checks for more than ]X HTML comments in an E-mail (preferably just counting ones in the middle ]of words, such as unsub!-- user --scribe, rather than to !-- ]user -- ]unsubscribe, as the former prevents filtering whereas the latter ]does not). Based on our research this should be a very good test. In fact Message Sniffer rule #18545 is the 11th strongest rule in the system! (That's just one slot out of the top 10). Testing for html comments with non whitespace on each side is key. Testing the number of html comments in general DOES NOT work. Much html email is generated automatically these days with many comments emitted for debugging purposes etc. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More more !--UserID--
... what is SpamChk...? It's an external test for declude and makes content based tests. At the moment it's in beta phase by some users on this list and on the declude spamtrap (www.declude.com/spamtrap.htm) We're preparing a website where everyone can read more about and download it for free... Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
