You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Svein Larsen <sv...@edbc.no> on 2004/02/19 10:14:32 UTC

Removing tags before scanning

Hi, does anybody know if spamassassing remove tags before scanning for
words like Viagra?
Spammers now build their html messages like this:

V<sna>ia<dsal>gra

and the html og this is going to be "Viagra" cause unknown tags are
ignored.

- Svein

Re: Removing tags before scanning

Posted by Bob Apthorpe <ap...@cynistar.net>.

On Thu, 19 Feb 2004 10:14:32 +0100 Svein Larsen <sv...@edbc.no> wrote:

> Hi, does anybody know if spamassassing remove tags before scanning for
> words like Viagra?
> Spammers now build their html messages like this:
> 
> V<sna>ia<dsal>gra
> 
> and the html og this is going to be "Viagra" cause unknown tags are
> ignored.

Yes, SA removes tags before analyzing the text.

-- Bob

Re: Removing tags before scanning

Posted by "Adam D. Lopresto" <ad...@pubcrawler.org>.

On Thu, 19 Feb 2004, Svein Larsen wrote:

> Hi, does anybody know if spamassassing remove tags before scanning for
> words like Viagra?
> Spammers now build their html messages like this:
>
> V<sna>ia<dsal>gra
>
> and the html og this is going to be "Viagra" cause unknown tags are
> ignored.

1) Out of the box, spamassassin will ignore the markup and catch the "Viagra"
there.

2) If you install Jennifer's Backhair set
(http://www.emtinc.net/spamhammers.htm) it'll be even better; that will
actually get 2 extra points for the (futile) attempt at obfuscation.
-- 
Adam Lopresto
http://cec.wustl.edu/~adam/

A cynic is a man who, when he smells flowers, looks around for a
coffin.  --H.L. Mencken