Sorry, I cut off the full URL. It should have been:
https://pastebin.com/5ASMFahi
On 12/12/2018 12:16 PM, Mark London wrote:
On 12/12/2018 8:01 AM, users-digest-h...@spamassassin.apache.org wrote:
On 10 Dec 2018, at 14:13, RW wrote:
On Mon, 10 Dec 2018 12:45:53 -0500
Mark London wrote:
Hi - Here's another form of obfuscation spam. This time, not a porn
blackmail one. Almost the whole text is obfuscated.
https://pastebin.com/VURwmrrF
You say obfuscated, but it looked completely unreadable to me.
The text/plain part is garbage, but the text/html part renders to a
mostly readable phish.
Bill Cole
Sorry, try this one, which was sent a day later, which is readable.
https://pastebin.com/edit/5ASMFah
I just put it through the latest spamasssassin rules. I see that it's
hitting some of the new rules:
T_HTML_SHRT_CMNT_OBFU_MANY,T_MIXED_ES,UNICODE_OBFU_ASC
It's still only being flagged as spam because of my high score
assigned to HTML_OBFUSCATE_90_100. I've had that high score for
years, never a false positive from it (yet!).
- Mark
