The spamcop uri tests and URIBL are your friends here. They will probably
catch those links and mark the thing out of consideration, unless you are
one of the unlucky few that get new links in the first few minutes.
I haven't figures out why that particular form of obfuscation is showing up
in the mails. I think it may be a spamware misfire. If you play around
with that you will find that you can move pieces around and form a complete
spam message. I suspect that was text for a table obfuscation spam, but it
didn't get placed into the table.
If you look at that stuff for a few minutes a fairly obvious rule to catch
it should become apparent.
Loren
----- Original Message -----
From: "Andrew Markebo" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, August 10, 2005 1:06 AM
Subject: Spamassassin and mystic generated mails..
> It happens once in a while that I get mails with subjects like:
>
> Subject: Re[3]: talk thread about his pills
>
> and it contains a bunch of random char words, and lots of links to
> like "Eugene.subsidises.net" where in the Eugene varies inside the
> mail and sibidises between the mail..
>
> So is it possible to in some way sort of count links, or count links
> that are equal in domain, somewhere in spamassassin?
>
> Or hmm a python-script.. could maybe do it.. ;-)
>
> /Andy
>
>
> The text is like (Lets hope that the one who knows doesn't skip this
> message ;-):
>
> Expe ce thr es lon gas rien
> ee tim ger or ms Wor de shi
> g wit hou ld Wi ppin hin 24
> rs SP -M UR The
> we and Saf Wa Ph
> acy is Ne st The
> est y of arm Inc e Yo
> xual Des Spe ume by % reas
> ur Se ire and rm vol 500 100
> ural and de Eff - in con t to wel wn bra
> % Nat No Si ects tras l-kno
> nds. Expe ce thr es lon gas
>
> The HTML like
>
> class=3Ds19>Usu</SPAN></A></TD>
> <TD><A href=3D"http://Ivanova.homespuns.net/vcl/?theman";><SPAN=20
> class=3Ds19>se is </SPAN></A></TD>
> <TD><A href=3D"http://Zapata.homespuns.net/vcl/?theman";><SPAN=20
> class=3Ds19>f A pil</SPAN></A></TD>
> <TD><A href=3D"http://Rempel.homespuns.net/vcl/?theman";><SPAN=20
> class=3Ds19>n Bef</SPAN></A></TD>
> <TD><A href=3D"http://Badova.homespuns.net/vcl/?theman";><SPAN=20
>
>
> --
> Remember don't look at the palm, look into it!
