spammer is using html code for spamming

[Eddy Beliveau <ed...@hec.ca>]

Hi!

I'm using spamassassin 2.64 with success

I'm having problem catching some specific spammer.

He is using html codes to generate his page
Each row of text is composed of word segments generated from many table row

Is there some rule who can catch this kind of spammers ?

Thanks,
Eddy

      Sa  p To 80   OF   R'eta   il Pri  ces With ED-D  
      ve U % F  rugs!   


<TABLE cellSpacing=0 cellPadding=0 border=0>
  <TR vAlign=bottom>
    <TD rowSpan=2 bgcolor="#adff2f">  
     <FONT face=Verdana  size=3>&nbsp;Sa</FONT></TD>
    <TD bgcolor="#adff2f"><font></font></TD>
    <TD rowSpan=2 bgcolor="#adff2f"><FONT face=Verdana size=3>p To&nbsp;80</FONT></TD>
    <TD bgcolor="#adff2f"><font></font></TD>
    <TD rowSpan=2 bgcolor="#adff2f"><FONT face=Verdana size=3>&nbsp;OF</FONT></TD>
    <TD bgcolor="#adff2f"><FONT></FONT></TD>
    <TD rowSpan=2 bgcolor="#adff2f"><FONT face=Verdana size=3>&nbsp;R'eta <FONT></FONT>
      </FONT></TD>
    <TD bgcolor="#adff2f"><FONT SIZE=1></FONT></TD>
    <TD rowSpan=2 bgcolor="#adff2f"><FONT face=Verdana size=3>il&nbsp;P<FONT></FONT>ri </FONT></TD>
    <TD rowSpan=2 bgcolor="#adff2f"><FONT face=Verdana size=3> ces With 
      ED-D</FONT></TD>
    <TD bgcolor="#adff2f"><FONT SIZE=1></FONT></TD>
  <TR>
    <TD bgcolor="#adff2f"><FONT face=Verdana size=3>ve U</FONT></TD>
    <TD bgcolor="#adff2f"><FONT face=Verdana size=3>%</FONT></TD>
    <TD bgcolor="#adff2f"><FONT face=Verdana size=3>F</FONT></TD>
    <TD bgcolor="#adff2f"><FONT></FONT></TD>
    <TD bgcolor="#adff2f"><FONT face=Verdana size=3>rugs!&nbsp; 
</TD></TR></TABLE></DIV></FONT>

Re: spammer is using html code for spamming

[Loren Wilton <lw...@earthlink.net>]

> He is using html codes to generate his page
> Each row of text is composed of word segments generated from many table
row

Nasty little guy, isn't he?


> Is there some rule who can catch this kind of spammers ?

The new SARE obfu rules have some good ones for this guy, but there is
currently a problem with the file, and you may want to wait till this
evening or so to download it.

        Loren

Re: spammer is using html code for spamming

[Eddy Beliveau <ed...@hec.ca>]

Many thanks,

I'll give it a try

Thanks again
Eddy
----- Original Message ----- 
From: "martin smith" <ma...@ntlworld.com>
To: "Spamassassin" <us...@spamassassin.apache.org>; "'Eddy Beliveau'" <ed...@hec.ca>
Sent: Thursday, May 12, 2005 12:30 PM
Subject: RE: spammer is using html code for spamming


> Whoops outlook capitalised this wrong with an I instead of i at the end.
> 
> This is what it should have been;
> 
> body MS_Body_Hide_DRUG /\b(?:R[!a-z]?eta il|P[!a-z]?ri ces|V.?I RA|C[!a-z]?I
> S|(?:V|U)L AM|U[!a-z]?LTRAM|S[!a-z]?MA)\b/i
>

RE: spammer is using html code for spamming

[martin smith <ma...@ntlworld.com>]

 Whoops outlook capitalised this wrong with an I instead of i at the end.

This is what it should have been;

body MS_Body_Hide_DRUG /\b(?:R[!a-z]?eta il|P[!a-z]?ri ces|V.?I RA|C[!a-z]?I
S|(?:V|U)L AM|U[!a-z]?LTRAM|S[!a-z]?MA)\b/i

RE: spammer is using html code for spamming

[martin smith <ma...@ntlworld.com>]

M>-----Original Message-----
M>From: Eddy Beliveau [mailto:eddy.beliveau@hec.ca] 
M>Sent: 12 May 2005 16:49
M>To: users@spamassassin.apache.org
M>Subject: spammer is using html code for spamming
M>
M>Hi!
M>
M>I'm using spamassassin 2.64 with success
M>
M>I'm having problem catching some specific spammer.
M>
M>He is using html codes to generate his page Each row of text 
M>is composed of word segments generated from many table row
M>
M>Is there some rule who can catch this kind of spammers ?
M>
M>Thanks,
M>Eddy
M>
M>      Sa  p To 80   OF   R'eta   il Pri  ces With ED-D  
M>      ve U % F  rugs!   
M>
M>
I have a rule which tagged this, if u want to give it a go.

body MS_Body_Hide_DRUG /\b(?:R[!a-z]?eta il|P[!a-z]?ri ces|V.?I RA|C[!a-z]?I
S|(?:V|U)L AM|U[!a-z]?LTRAM|S[!a-z]?MA)\b/I

score MS_Body_Hide_DRUG 2.5

describe MS_Body_Hide_DRUG Trying to hide prescription drugs

Martin