Hello Bob,

Wednesday, May 19, 2004, 5:55:17 PM, you wrote:

BA> There's a lot of junk text, complete, normal, and irrelevant sentences
BA> in the text/plain part; the text/html part contains tons of
BA> numerically-encoded entities, including the following:
BA> <A href="&#104;&#116;&#116;&#112;&#58;...
BA> which translates to:
BA> <A href="http://Gabriel.oem-licensed-soft.biz/?Bob";><STRONG>Pleayse
BA> followf here noww!</STRONG></A>

BA> Question #0: Does _anything_ render that? Why?

I expect that any html-friendly client will render that as the spammer
desires.

BA> Question #1: Isn't there a ruleset in 2.63 (stock or SARE) that flags
BA> such exhuberant use of entities?

Following rule is included in the new HTML rule set going final
pre-publication mass-check now:

uri       SARE_HTML_URI_OBFU3      /(&\#(\d){3};){4,8}/i
describe  SARE_HTML_URI_OBFU3      URI with obfuscated destination 
score     SARE_HTML_URI_OBFU3      1.666
#counts   SARE_HTML_URI_OBFU3       42s/0h of 93179 corpus (71385s/21794h RM) 
05/16/04
#max      SARE_HTML_URI_OBFU3      329s/0h of 97268 corpus (79437s/17831h RM) 
01/24/04
#counts   SARE_HTML_URI_OBFU3       14s/0h of 32260 corpus ( 8983s/23277h JH) 
05/14/04
#hist     SARE_HTML_URI_OBFU3      Mike Kuentz <[EMAIL PROTECTED]>

Bob Menschel



Reply via email to