You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Marc Perkel <su...@junkemailfilter.com> on 2013/06/07 15:21:07 UTC
Need rules to catch this kind of spam
This is the content of the spam. I get a lot of these and like to see a
rule specifically targeting it. You probably have seen it. Lots of low
contrast colors and font size changes and one link visible.
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>
</head>
<body>
<p><FONT face="Arial Narrow, sans-serif" size="+1"
color="#f4f2ff">it</FONT> <FONT face="Impact, Times New Roman" size="+2"
color="#f2f0fd">to</FONT> <FONT face="Century Gothic, Arial" size="2"
color="#e8e4fe">Allan</FONT> <FONT face="Lucida Console, Arial" size="2"
color="#e4e0fa">Ramsay.[43:2]</FONT> <FONT face="Times New Roman, Times,
serif" size="2" color="#e8e4ff">I</FONT> <FONT face="Lucida Console, Monaco,
monospace" size="2" color="#e4e0fb">find</FONT> <FONT face="Comic Sans MS,
cursive"
size="2" color="#f9f8ff">the</FONT> <FONT face="Georgia" size="3"
color="#f2f0fe">ingenious</FONT> <FONT face="Courier New, Courier,
monospace" size="-2" color="#e4e0fc">author, <FONT face="Impact, Times New
Roman" size="-1" color="#e4e0fd">whoever</FONT> <FONT face="Microsoft Sans
Serif, Times New Roman" size="-1" color="#f2f0ff">he</FONT> <FONT
face="Geneva, Arial, Helvetica, sans-serif" size="-2"
color="#e4e0fe">be,</FONT></p>
<p><FONT face="Impact, Times New Roman" size="3" color="#080000">Cheers,
handsome. I'm in your area. I am romantic. <a
href="http://igtivilo.php0h.com/">Click for more info</a></FONT></p>
<p><FONT face="Garamond, Times New Roman" size="5"
color="#e4e0ff">ridicules</FONT> <FONT face="Tahoma, sans-serif" size="+1"
color="#fefeff">the</FONT> <FONT face="Garamond, Arial" size="4"
color="#fdfdfe">new</FONT> <FONT face="Lucida Sans Unicode, Lucida Grande,
sans-serif" size="3" color="#fcfcfd">method</FONT> <FONT face="Courier New,
Courier, monospace" size="-1" color="#fbfbfc">of</FONT> <FONT face="Courier
New, monospace" size="4" color="#fafafb">spelling,</FONT> <FONT face="Arial"
size="2" color="#f9f9fa">as</FONT> <FONT face="Impact, Times New Roman"
size="3" color="#f8f8f9">he</FONT> <FONT face="Impact, Times New Roman"
size="5" color="#fdfdff">calls <FONT face="Comic Sans MS, Times New Roman"
size="4" color="#fcfcfe">it;</FONT></p>
<p><FONT face="Comic Sans MS, Arial" size="+2"
color="#100000">http://zouqqihu.isthe.name/</FONT></p>
<p><FONT face="Lucida Sans Unicode, Lucida Grande, sans-serif" size="2"
color="#fbfbfd">but</FONT> <FONT face="Charcoal, sans-serif" size="+1"
color="#fafafc">that</FONT> <FONT face="Book Antiqua, Times New Roman"
size="-2" color="#f9f9fb">method</FONT> <FONT face="Palatino, serif"
size="+2" color="#f8f8fa">of</FONT> <FONT face="Lucida Sans Unicode, Lucida
Grande, sans-serif" size="2" color="#f6f6f8">spelling</FONT> <FONT
face="Microsoft Sans Serif, Arial" size="5" color="#f4f4f6">_honor_,</FONT>
<FONT face="Georgia, serif"
size="5" color="#f2f2f4">instead</FONT> <FONT face="Bookman Old Style,
Arial" size="2" color="#f0f0f2">of</FONT> <FONT face="Geneva, sans-serif"
size="-2" color="#fcfcff">_honour_,</p>
<p><FONT face="Georgia" size="4" color="#fbfbfe">was</FONT> <FONT
face="Trebuchet MS, sans-serif" size="2" color="#fafafd">Lord</FONT> <FONT
face="Book Antiqua, Arial" size="2" color="#f9f9fc">Bolingbroke's,</FONT>
<FONT face="Book Antiqua, Times New Roman" size="3"
color="#f8f8fb">Dr.</FONT> <FONT face="Arial Narrow, Arial" size="4"
color="#f6f6f9">Middleton's,</FONT> <FONT face="Arial" size="3"
color="#fbfbff">and</FONT></p>
<p><FONT face="Arial Narrow, sans-serif" size="5"
color="#fafafe">Mr.</FONT> <FONT face="Book Antiqua, Times New Roman"
size="+1" color="#f9f9fd">Pope's;</FONT> <FONT face="Book Antiqua, Arial"
size="3" color="#f8f8fc">besides</FONT> <FONT face="Bookman Old Style,
Arial" size="+2" color="#f6f6fa">many</FONT> <FONT face="Geneva, sans-serif"
size="2" color="#f4f4f8">other</FONT></p>
<p><FONT face="Lucida Sans Unicode, Arial" size="-1"
color="#f2f2f6"></FONT> </p>
</body>
</html>
--
Marc Perkel - Sales/Support
support@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400
Re: Need rules to catch this kind of spam
Posted by John Hardin <jh...@impsec.org>.
On Fri, 7 Jun 2013, Marc Perkel wrote:
> This is the content of the spam. I get a lot of these and like to see a rule
> specifically targeting it. You probably have seen it. Lots of low contrast
> colors and font size changes and one link visible.
Mark, could you forward one such to me as an RFC822 attachment so that I
have a full sample? There's one obvious thing in there that looks like
good rule fodder to me.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Our government wants to do everything it can "for the children,"
except sparing them crushing tax burdens.
-----------------------------------------------------------------------
372 days since the first successful private support mission to ISS (SpaceX)
Re: Need rules to catch this kind of spam
Posted by Benny Pedersen <me...@junc.eu>.
Marc Perkel skrev den 2013-06-07 15:21:
> This is the content of the spam. I get a lot of these and like to see
> a rule specifically targeting it. You probably have seen it. Lots of
> low contrast colors and font size changes and one link visible.
and the one link is not blocked yet ?
spammers is known stupid, but if antispammers is like them its even
more stupid :)
--
senders that put my email into body content will deliver it to my own
trashcan, so if you like to get reply, dont do it