The
"one pixel image tracker" rule that I posted some time ago would've caught this
as well.
Daz
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: 27 May 2003 15:16
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: Re: [SAtalk] How detect messages like these?
Thanks for the reply.
Any chance SA could include these sorts of rules (especially the one about letters that don't belong together in english) as part of the default set of rules?
I don't really know how to setup my own rules, how would I do what you described below?
Thanks
Ricardo
On Tue, 27 May 2003 10:09:24 -0400 Chris Santerre wrote:
>
>
> > -----Original Message-----
> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
> > Sent: Monday, May 26, 2003 8:15 PM
> > To: [EMAIL PROTECTED]
> > Subject: [SAtalk] How detect messages like these?
> >
> >
> > Hi,
> >
> > Lately I've been getting a lot of messages which have little
> > or no text
> > in them, they just have an image with the spam.
> >
> > How can SA catch this sort of thing?
> >
> > Thanks
> > Ricardo
> >
> > ---------- Forwarded message ----------
> > From: Kristy <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Date: Mon, 26 May 2003 13:13:20 -0400
> > Subject: You get my message?
> >
> > <html>
> > <body>
> > <br>
> > <center>
> > <img
> > src=""HTTP: i? u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com>http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/i
> > mage.asp?cmp
> > id=vigrex-106.gif&dvn=25J82C6x1L_L85fwJ6L" width="0" height="0">
> > <br>
> > <a
> > href=""HTTP: u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com ?>http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/
> > ctrack.asp?c
> > mpid=vigrex-106&cvn=A[,dA9siFznzd[S0,sz">
> > <img
> > src=""HTTP: vigrex-106.gif"? u4j6u80zbzid3d64zozaj0d.stop-and-shop.net>http://u4j6u80zbzid3d64zozaj0d.stop-and-shop.net/vigrex-106.gif";
> > border="0"></a>
> > <br>
> > <br>
> > <a
> > href=""http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/">http://u4j6u80zbzid3d64zozaj0d.online-shop-exchange.com/
> > remove/remov
> > e.asp">
> > <img src=""HTTP: u4j6u80zbzid3d64zozaj0d.stop-and-shop.net unsub.gif"?>http://u4j6u80zbzid3d64zozaj0d.stop-and-shop.net/unsub.gif";
> > border="0"></a>
> > </center>
> > </body>
> > </html>
> >
>
> Several ways. All of these scored small, and let them add up.
> Search for:
> online.?shop
> c?track.asp
> and my favorite.... letters that don't belong together in english:
> /z(j|b|x)/i and so on........ One rule for each letter, like
> /j(z|x|b)/i
> .......
>
> Also keep a rule for tagging your own known spammers.
> /22its4you\.(net|com)/i
>
>
>
>
>
