Re: More undetected hidden test spam signs

2020-12-22 Thread Loren Wilton
Right, but __STY_INVIS is currently tag-blind (it only looks for the style="" clause), so it hits that, and if lots of ham is hiding tracking images that way that might explain the poor S/O. I suspect that might be the case. The vast majority of invisible garbage I see is hidden in a ...

Re: More undetected hidden test spam signs

2020-12-22 Thread John Hardin
On Tue, 22 Dec 2020, Loren Wilton wrote: On 16 Dec 2020, at 23:21, Loren Wilton wrote: I just got a batch of spams containing Such rules are there. Unfortunately, for whatever reason, lots of ham uses "invisible" text so it's not useful as a spam sign by itself and it's hard to come up

Re: More undetected hidden test spam signs

2020-12-22 Thread Loren Wilton
On 16 Dec 2020, at 23:21, Loren Wilton wrote: I just got a batch of spams containing Such rules are there. Unfortunately, for whatever reason, lots of ham uses "invisible" text so it's not useful as a spam sign by itself and it's hard to come up with any useful combination rules. I

Re: More undetected hidden test spam signs

2020-12-22 Thread John Hardin
On Thu, 17 Dec 2020, John Hardin wrote: On Thu, 17 Dec 2020, @lbutlr wrote: On 16 Dec 2020, at 23:21, Loren Wilton wrote: I just got a batch of spams containing Interesting. I remember in the early days of html spam there were various rules to tag messages as spam when they had content

Re: More undetected hidden test spam signs

2020-12-18 Thread RW
On Thu, 17 Dec 2020 08:58:07 -0800 (PST) John Hardin wrote: > On Thu, 17 Dec 2020, @lbutlr wrote: > > > On 16 Dec 2020, at 23:21, Loren Wilton > > wrote: > >> I just got a batch of spams containing > >> > >> > > > > ... various rules to tag messages as spam when they had content that > >

Re: More undetected hidden test spam signs

2020-12-18 Thread @lbutlr
On 17 Dec 2020, at 09:58, John Hardin wrote: > Such rules are there. Unfortunately, for whatever reason, lots of ham uses > "invisible" text so it's not useful as a spam sign by itself and it's hard to > come up with any useful combination rules. In the "Archive" folder on my work email there

Re: More undetected hidden test spam signs

2020-12-17 Thread John Hardin
On Thu, 17 Dec 2020, @lbutlr wrote: On 16 Dec 2020, at 23:21, Loren Wilton wrote: I just got a batch of spams containing Interesting. I remember in the early days of html spam there were various rules to tag messages as spam when they had content that did not display. (Possibly

Re: More undetected hidden test spam signs

2020-12-17 Thread RW
On Wed, 16 Dec 2020 22:21:12 -0800 Loren Wilton wrote: > I just got a batch of spams containing > > > > That was followed by about 2K bytes of garbage containing GUIDs and > links to putatively some youtube video. The span was then terminated > correctly, the body of the spam, and then the

Re: More undetected hidden test spam signs

2020-12-17 Thread @lbutlr
On 16 Dec 2020, at 23:21, Loren Wilton wrote: > I just got a batch of spams containing > > Interesting. I remember in the early days of html spam there were various rules to tag messages as spam when they had content that did not display. (Possibly pre-SpamAssasin or at least pre my use of

More undetected hidden test spam signs

2020-12-16 Thread Loren Wilton
I just got a batch of spams containing That was followed by about 2K bytes of garbage containing GUIDs and links to putatively some youtube video. The span was then terminated correctly, the body of the spam, and then the same garbage for about another 2KB. The small font rules didn't seem