A message containing a very bright font used to conceal Bayes poison got through yesterday.

Spamassassin score was:

X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
   nmail.altkom.pl
X-Spam-Status: No, hits=1.9 required=5.0 tests=BAYES_50,
   HTML_FONTCOLOR_UNKNOWN,HTML_MESSAGE,MIME_HTML_ONLY,SUBJECT_PHARMACY
   autolearn=no version=2.60
X-Spam-Level: *

Relevant fragments:

--- Start sample ---
<font color=

#fee4e8> sleepwalk negotiate sonic, diluting democrat humpback, encamping palaces MacDonald Hewlett brainstem crops cautions chartering discharged chronicle disagree presided accordion. sentiments transplant corpse defeat downright, immersed Boltzmann skulk beatitudes espouse planks palmer compresses populace almsman bivouac tolerance. cookery Ridgway scalded. ribbing mockery Oakley glover reopens satellites.</font><br>
ONLY REAL SUPER VIAGDRA CALLED CIADLIS IS EFFECTIVE! Annual Sale: ONLY $3 per dose<br>
--- End sample ---


another one:

--- Start sample ---
<font color=

#ebeff4>whitely chord cowing gayety aviary, nostalgic glucose Hyannis employ; subdued movements mischief smartly intonation reserved distaff standoff terrifies. heavily acquirable beach adulthood invertible, traversing vacuo enraged Dobbin Avogadro Agnes Bruno enfeeble credible notorious carelessly octaves. negotiate makeup SIMULA. sagebrush imaginably heiressesfalcons.</font><br>
--- End sample ---


Anybody got a rule for this type of stuff?

BTW I've refined the rule that catches invisible font sizes to include 0 and 1 pixel/point fontsizes:

rawbody LOCAL_ZERO_FONTSIZE     /\bfont-size\: ?[01]p[xt]\b/i

Please check if it hits your ham.

--
Best Regards,
Aleksander Adamowski
GG#: 274614
ICQ UIN: 19780575 http://olo.ab.altkom.pl





Reply via email to