You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Rick Measham <ri...@measham.id.au> on 2005/11/28 03:43:56 UTC
Vertical Spam
I'm having a problem with spam set in an html table in such a way that
it doesn't read like spam...
<TABLE cellSpacing=0 style="WHITE-SPACE: normal;" cellPadding=0>
<TR>
<TD><FONT face="Courier">V V A X L C P</FONT></TD>
<TD><FONT face="Courier">A I m a e I r</FONT></TD>
<TD><FONT face="Courier">L A b n v A o</FONT></TD>
<TD><FONT face="Courier">I G i a i L z</FONT></TD>
<TD><FONT face="Courier">U R e x t I a</FONT></TD>
<TD><FONT face="Courier">M A n <BR> ra S c</FONT></TD>
<TD><FONT face="Courier"> 1,22 3,32 <BR> <BR>
<BR> 3,75 <BR></FONT></TD>
<TD width=100%></TD>
</TR>
</TABLE>
Because of the final 100% width TD, all the others get squished up to
the point where each letter is on a new line .. thus it renders as:
VALIUM 1,22
VIAGRA 3,32
Ambien
Xanax
Levitra
CIALIS 3,75
Prozac
Does anyone know any way to filter this? I could check for a table cell
that only contains single-letter words .. but I'd prefer to be more
exact than that.
Cheers!
Rick Measham
--
"War is God's way of teaching Americans geography."
-- Ambrose Bierce
Re: Vertical Spam
Posted by Loren Wilton <lw...@earthlink.net>.
There have been a number of rules suggested for this in the last couple
weeks.
I think we have some rules for this in SARE now, probably in specific.cf or
maybe one of the obfu rule sets.
Loren
Re: Vertical Spam
Posted by Jeremy <jf...@hotmail.com>.
I'd recommend using the SARE rules (www.rulesemporium.com/rules.htm), which
do detect this little HTML trick - specifically, the rule "specific.cf" is
the one that detects this type of spam. But using a bunch of the SARE rules
is always a good idea to help detect other types of spam.
I created my own couple of rules for this particular vertical HTML trick,
which I've found to be very effective on my system at bumping up the scores
for these spams - see attached. I get hits against them almost every day.
Use at your own risk and score according to your needs!
Cheers,
Jeremy
"Rick Measham" <ri...@measham.id.au> wrote in message
news:438A6EEC.6050507@measham.id.au...
> I'm having a problem with spam set in an html table in such a way that
> it doesn't read like spam...
>
> <TABLE cellSpacing=0 style="WHITE-SPACE: normal;" cellPadding=0>
> <TR>
> <TD><FONT face="Courier">V V A X L C P</FONT></TD>
> <TD><FONT face="Courier">A I m a e I r</FONT></TD>
> <TD><FONT face="Courier">L A b n v A o</FONT></TD>
> <TD><FONT face="Courier">I G i a i L z</FONT></TD>
> <TD><FONT face="Courier">U R e x t I a</FONT></TD>
> <TD><FONT face="Courier">M A n <BR> ra S c</FONT></TD>
> <TD><FONT face="Courier"> 1,22 3,32 <BR> <BR>
> <BR> 3,75 <BR></FONT></TD>
> <TD width=100%></TD>
> </TR>
> </TABLE>
>
> Because of the final 100% width TD, all the others get squished up to
> the point where each letter is on a new line .. thus it renders as:
>
> VALIUM 1,22
> VIAGRA 3,32
> Ambien
> Xanax
> Levitra
> CIALIS 3,75
> Prozac
>
> Does anyone know any way to filter this? I could check for a table cell
> that only contains single-letter words .. but I'd prefer to be more
> exact than that.
>
> Cheers!
> Rick Measham
>
>
> --
> "War is God's way of teaching Americans geography."
> -- Ambrose Bierce
begin 666 verticalhtmltable.cf
M<F%W8F]D>2!?7TI&7TA434Q404),13%?02 @("!M)SQT9"!W:61T:"Y[,2PS
M?3$P,"4^/"]T9#XG:0T*9G5L;"!?7TI&7TA434Q404),13%?0B @("!M)SX@
M/R@_.EMA+7I!+5HP+3E=("E[,RPW?5MA+7I!+5HP+3E=/"]F;VYT/CPO=&0^
M+GLT+#4P?3X@/R@_.EMA+7I!+5HP+3E=("E[,RPW?5MA+7I!+5HP+3E=/"]F
M;VYT/CPO=&0^+GLT+#4P?3X@/R@_.EMA+7I!+5HP+3E=("E[,RPW?5MA+7I!
M+5HP+3E=/"]F;VYT/CPO=&0^)VES#0IM971A($I&7TA434Q404),13$@(" @
M*%]?2D9?2%1-3%1!0DQ%,B F)B!?7TI&7TA434Q404),13$I#0ID97-C<FEB
M92!*1E](5$U,5$%"3$4Q(" @($-O;G1A:6YS('9E<G1I8V%L($A434P@=&%B
M;&4@=')I8VL-"G-C;W)E($I&7TA434Q404),13$@(" @-BXP#0H-"F9U;&P@
M2D9?2%1-3%1!0DQ%,B @("!M)V9L;V%T.B!L969T+BH_/CQF;VYT+BL_/B@_
M.B!\)FYB<W [*3\H/SI;82UZ02U:,"TY73QB<CXI>S,L-WU;82UZ02U:,"TY
M73PO9F]N=#X\+V1I=CXN*S]F;&]A=#H@;&5F="XJ/SX\9F]N="XK/SXH/SH@
M?"9N8G-P.RD_*#\Z6V$M>D$M6C M.5T\8G(^*7LS+#=]6V$M>D$M6C M.5T\
M+V9O;G0^/"]D:78^+BL_9FQO870Z(&QE9G0N*C\^/&9O;G0N*S\^*#\Z('PF
M;F)S<#LI/R@_.EMA+7I!+5HP+3E=/&)R/BE[,RPW?5MA+7I!+5HP+3E=/"]F
M;VYT/CPO9&EV/B=I<PT*9&5S8W)I8F4@2D9?2%1-3%1!0DQ%,B @("!#;VYT
M86EN<R!V97)T:6-A;"!(5$U,('1A8FQE('1R:6-K#0IS8V]R92!*1E](5$U,
/5$%"3$4R(" @(#8N, T*
`
end