Rule for this ??

[Jean-Paul Natola <jn...@familycareintl.org>]

Here's an intelligent html coder

 

I viewed the source of the code because I was curious as to how these words
flew right through my SA ,

 

You will note that if turned into plain text  , he used a bunch of tables and
cells to produce the following;

 

 

________________________________

From: Firoz Granger [mailto:gra@glock.squawk.com] 
Sent: Friday, November 11, 2005 4:49 AM
To: Jean-Paul Natola
Subject: Glen: interesting information

 

Hi,

Qui

 

ing f

 

ications - vis <http://yelountYeeBrad.tripod.com> 

 

aExpres <http://yelountYeeBrad.tripod.com> 

 

op <http://yelountYeeBrad.tripod.com> 

 

t overpay

or your Medd

it our Pharm <http://yelountYeeBrad.tripod.com> 

s Sh <http://yelountYeeBrad.tripod.com> 

 

 

P V C X V A

r I I a A m

o A A n L b

z G L a I i

a R I x U e

c A S  
M n

 
 69,95  99,95  
 85,45  

 

 

 

What rule, if any , can combat this?

Re: Rule for this ??

[Matt Kettler <mk...@evi-inc.com>]

Jean-Paul Natola wrote:
> Here’s an intelligent html coder
> 
>  
> 
> I viewed the source of the code because I was curious as to how these
> words flew right through my SA ,
> 
>  
> 
> You will note that if turned into plain text  , he used a bunch of
> tables and cells to produce the following;

Try this on for size:

body L_COLUMN_VIAG
/\bv(?:\s\w){4,6}\si(?:\s\w){4,6}\sa(?:\s\w){4,6}\sg(?:\s\w){4,6}\sr(?:\s\w){4,6}\sa\b/i
describe L_COLUMN_VIAG looks like a column-obfuscated v-pill ad
score L_COLUMN_VIAG     0.1

Warning: new rule, not well tested, hence the limited score. I just placed this
on my live server to see how it behaves.

Of course, there are some limitations to this rule that a spammer can use to get
around it, but the general concept of the new gap clause of (?:\s\w){4,6}\s can
be adapted to catch future variants with different table attributes.