> -----Original Message----- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: Thursday, January 22, 2004 8:13 PM > To: Larry Gilson > Cc: Spamassassin-Talk (E-mail) > Subject: Re[2]: [SAtalk] SA missed an 'invisible font'? > > Hello Larry, > > Wednesday, January 21, 2004, 11:37:09 PM, you wrote: > > LG> Along the same lines, I had the following: > > LG> describe MY_RBDY_INVTXTSZ1 MY: Invisible text size > LG> rawbody MY_RBDY_INVTXTSZ1 /font\s+.*\bsize=.-\d\D/i > LG> score MY_RBDY_INVTXTSZ1 0.5 > > LG> describe MY_RBDY_INVTXTSZ2 MY: Invisible text size with style > LG> rawbody MY_RBDY_INVTXTSZ2 /size=.-\d\D style=.font-size: \dpx;\D/i > LG> score MY_RBDY_INVTXTSZ2 0.5 > > LG> describe MY_RBDY_INVIMGSZE MY: Invisible image size > LG> rawbody MY_RBDY_INVIMGSZE /width=.1\D height=.1\D/i > LG> score MY_RBDY_INVIMGSZE 0.5 > > LG> They seem to hit legit opt-in advertisements though. I would be > LG> curious to see the results against your corpus if you are inclined > LG> and willing to spend the time. > > MY_RBDY_INVTXTSZ1 -- 5002s/876h of 91714 corpus (74113s/17601h) 01/22/04 > > Note that a <font size=-1> or -2 is not an invisible font size, but > simply a reduced font size.
Agreed. I only name it that in the context for which I saw it - spam obfuscation. The intent was to make it disappear. I did notice this one in HTML newsletters. I did not expect such a high ham hit though. > MY_RBDY_INVTXTSZ2 -- 463s/0h of 91714 corpus (74113s/17601h) 01/22/04 > > I wouldn't think that any font-size in pixels would be "invisible", since > one could do anything from tiny to gigantic using that specification, but > in my corpus it hits only spam. Oohh. I got lucky. Again, the naming convention was more for the context of the application. > MY_RBDY_INVIMGSZE -- 2190s/158h of 91714 corpus (74113s/17601h) 01/22/04 > > ham hit is mostly HTML newsletters from accepted sources and/or YahooGroups. I guess this one does not surprise me. It seems to be used for tracking. Thanks Bob! Your effort is much appreciated! --Larry ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
