You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Andy Jezierski <AJ...@stepan.com> on 2014/01/29 17:53:43 UTC
Help with a regex to catch spam with gibberish html tags
I've been noticing a lot of spam getting through with the same traits, a
bunch of random words within brackets. They all seem to come after the
</body> or the </html> tag. Anyone much more knowledgeable than me care
to assist with a rule to detect them?
Thanks
Andy
Example:
</html>
</body>
<style>
<geehrter>
<convaincre>
<eingerichtet>
<piuttosto>
<meny>
<Aufl>
<quilting>
<surveymonkey>
<update>
<Benoit>
<problemi>
<ese>
<telstra>
<checking>
<aglow>
<insegna>
<doorgeven>
Re: Help with a regex to catch spam with gibberish html tags
Posted by Andy Jezierski <AJ...@stepan.com>.
Amir Caspi <ce...@3phase.com> wrote on 01/30/2014 11:39:51 AM:
> From: Amir Caspi <ce...@3phase.com>
> To: "Kevin A. McGrail" <KM...@PCCC.com>,
> Cc: Andy Jezierski <AJ...@stepan.com>,
> "users@spamassassin.apache.org" <us...@spamassassin.apache.org>
> Date: 01/30/2014 11:40 AM
> Subject: Re: Help with a regex to catch spam with gibberish html tags
>
> On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KM...@PCCC.com>
wrote:
>
> If you want to share the complete rule, I can throw it into my
> sandbox and see what masscheck thinks as well.
>
> The complete rule would be something like this, assuming Andy
> implemented it as I wrote it:
>
> rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}/
> describe HTML_NONSENSE_TAGS Many consecutive multi-letter HTML tags,
> likely nonsense/spam
> score HTML_NONSENSE_TAGS 0.001
>
> Score to be adjusted as needed, of course.
>
> If one wants to be even more explicit, one could require that the
> tags be prefaced with a <style> tag, although that should,
> hopefully, get picked up by John Hardin's modifications to
> STYLE_GIBBERISH sometime in the near future.
>
> Cheers.
>
> --- Amir
That would indeed be the rule I used.
Andy
Re: Help with a regex to catch spam with gibberish html tags
Posted by Amir Caspi <ce...@3phase.com>.
On Jan 30, 2014, at 11:25 AM, John Hardin <jh...@impsec.org> wrote:
> I'd suggest writing it as a subrule first, to see how well it performs against the masscheck corpora. If it does well by itself (good hits, high S/O), then a meta can be added to expose it for scoring. If it hits a lot but the S/O ratio is low, then it could be analyzed for possible combinations with other rules to get something that performs well.
Certainly a good idea, but since I'm not familiar with how the masscheck corpora work, I don't know what changes are required for this. Hopefully you or Kevin can handle the necessary changes for that...
--- Amir
Re: Help with a regex to catch spam with gibberish html tags
Posted by John Hardin <jh...@impsec.org>.
On Thu, 30 Jan 2014, Kevin A. McGrail wrote:
> On 1/30/2014 1:25 PM, John Hardin wrote:
>>
>> I'd suggest writing it as a subrule first, to see how well it performs
>> against the masscheck corpora. If it does well by itself (good hits, high
>> S/O), then a meta can be added to expose it for scoring. If it hits a lot
>> but the S/O ratio is low, then it could be analyzed for possible
>> combinations with other rules to get something that performs well.
>
> I think that's overkill and I've already added it to masscheck to see how it
> does with a ceiling of 2 on the scoring so we can get some feedback and
> adjust.
>
> Otherwise, my POV is that masscheck is designed just for that purpose and
> check if the rule has merits to move to publish.
>
> I could be persuaded for a lower-score ceiling or a nopublish flag if you
> insist though.
Eh, no, that's fine. I'm more interested in not ignoring rules that will
potentially be very useful in combination if they don't perform well on
their own. If it doesn't perform well enough to publish, or gets a low
score, then we can look at overlaps to see if a combination meta would
help.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
For those who are being swayed by Microsoft's whining about the
GPL, consider how aggressively viral their Shared Source license is:
If you've *ever* seen *any* MS code covered by the Shared Source
license, you're infected for life. MS can sue you for Intellectual
Property misappropriation whenever they like, so you'd better not
come up with any Innovative Ideas that they want to Embrace...
-----------------------------------------------------------------------
2 days until the 11st anniversary of the loss of STS-107 Columbia
Re: Help with a regex to catch spam with gibberish html tags
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 1/30/2014 1:25 PM, John Hardin wrote:
> On Thu, 30 Jan 2014, Amir Caspi wrote:
>
>> On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KM...@PCCC.com>
>> wrote:
>>
>>> If you want to share the complete rule, I can throw it into my
>>> sandbox and see what masscheck thinks as well.
>>
>> The complete rule would be something like this, assuming Andy
>> implemented it as I wrote it:
>>
>> rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}/
>> describe HTML_NONSENSE_TAGS Many consecutive multi-letter HTML
>> tags, likely nonsense/spam
>> score HTML_NONSENSE_TAGS 0.001
>>
>> Score to be adjusted as needed, of course.
>
> I'd suggest writing it as a subrule first, to see how well it performs
> against the masscheck corpora. If it does well by itself (good hits,
> high S/O), then a meta can be added to expose it for scoring. If it
> hits a lot but the S/O ratio is low, then it could be analyzed for
> possible combinations with other rules to get something that performs
> well.
>
I think that's overkill and I've already added it to masscheck to see
how it does with a ceiling of 2 on the scoring so we can get some
feedback and adjust.
Otherwise, my POV is that masscheck is designed just for that purpose
and check if the rule has merits to move to publish.
I could be persuaded for a lower-score ceiling or a nopublish flag if
you insist though.
Regards,
KAM
Re: Help with a regex to catch spam with gibberish html tags
Posted by John Hardin <jh...@impsec.org>.
On Thu, 30 Jan 2014, Amir Caspi wrote:
> On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KM...@PCCC.com> wrote:
>
>> If you want to share the complete rule, I can throw it into my sandbox and see what masscheck thinks as well.
>
> The complete rule would be something like this, assuming Andy implemented it as I wrote it:
>
> rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}/
> describe HTML_NONSENSE_TAGS Many consecutive multi-letter HTML tags, likely nonsense/spam
> score HTML_NONSENSE_TAGS 0.001
>
> Score to be adjusted as needed, of course.
I'd suggest writing it as a subrule first, to see how well it performs
against the masscheck corpora. If it does well by itself (good hits, high
S/O), then a meta can be added to expose it for scoring. If it hits a lot
but the S/O ratio is low, then it could be analyzed for possible
combinations with other rules to get something that performs well.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
For those who are being swayed by Microsoft's whining about the
GPL, consider how aggressively viral their Shared Source license is:
If you've *ever* seen *any* MS code covered by the Shared Source
license, you're infected for life. MS can sue you for Intellectual
Property misappropriation whenever they like, so you'd better not
come up with any Innovative Ideas that they want to Embrace...
-----------------------------------------------------------------------
2 days until the 11st anniversary of the loss of STS-107 Columbia
Re: Help with a regex to catch spam with gibberish html tags
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 1/30/2014 12:39 PM, Amir Caspi wrote:
> On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KMcGrail@PCCC.com
> <ma...@PCCC.com>> wrote:
>
>> If you want to share the complete rule, I can throw it into my
>> sandbox and see what masscheck thinks as well.
>
> The complete rule would be something like this, assuming Andy
> implemented it as I wrote it:
>
> rawbody HTML_NONSENSE_TAGS/(?:<[A-Za-z0-9]{4,}>\s*){10,}/
> describe HTML_NONSENSE_TAGSMany consecutive multi-letter HTML tags,
> likely nonsense/spam
> score HTML_NONSENSE_TAGS0.001
>
> Score to be adjusted as needed, of course.
>
> If one wants to be even more explicit, one could require that the tags
> be prefaced with a <style> tag, although that should, hopefully, get
> picked up by John Hardin's modifications to STYLE_GIBBERISH sometime
> in the near future.
>
> Cheers.
>
> --- Amir
Added to the sandbox. In a day or three, we should be able to check the
ruleQA and see what it looks like on the masscheck corpora.
svn commit -m 'Adding html tag gibberish tag rule for testing from
Amir Caspi on the mailing list'
Adding rulesrc/sandbox/kmcgrail/20_mailing_list.cf
Transmitting file data .
Committed revision 1562916.
Rule is called AC_HTML_NONSENSE_TAGS and you can then look at it on
http://ruleqa.spamassassin.org/
The S/O is the big thing to look at http://wiki.apache.org/spamassassin/S/O
Regards,
KAM
Re: Help with a regex to catch spam with gibberish html tags
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 1/30/2014 6:37 PM, David B Funk wrote:
> On Thu, 30 Jan 2014, Amir Caspi wrote:
>
>> On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KM...@PCCC.com>
>> wrote:
>>
>> If you want to share the complete rule, I can throw it into my
>> sandbox and see what masscheck thinks as well.
>>
>>
>> The complete rule would be something like this, assuming Andy
>> implemented it as I wrote it:
>>
>> rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}/
>> describe HTML_NONSENSE_TAGS Many consecutive multi-letter HTML tags,
>> likely nonsense/spam
>> score HTML_NONSENSE_TAGS 0.001
>
> Actually that unbounded {10,} repeat can be written as an explicit
> {10} with out
> reducing the effectiveness of the rule and make it more CPU efficient.
> IE once
> you've found at least 10 consecutive pseudo-tags do you care if there
> are more
> than 10 (since you're not looking for anything specific after the
> match nor
> doing anything with knowing the exact number of them)
Just an FYI that I checked a bit ago and AC_HTML_NONSENSE_TAGS was
promoted to a published rule scoring 0.51.
Regards,
KAM
Re: Help with a regex to catch spam with gibberish html tags
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 1/30/2014 6:37 PM, David B Funk wrote:
> On Thu, 30 Jan 2014, Amir Caspi wrote:
>
>> On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KM...@PCCC.com>
>> wrote:
>>
>> If you want to share the complete rule, I can throw it into my
>> sandbox and see what masscheck thinks as well.
>>
>>
>> The complete rule would be something like this, assuming Andy
>> implemented it as I wrote it:
>>
>> rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}/
>> describe HTML_NONSENSE_TAGS Many consecutive multi-letter HTML tags,
>> likely nonsense/spam
>> score HTML_NONSENSE_TAGS 0.001
>
> Actually that unbounded {10,} repeat can be written as an explicit
> {10} with out
> reducing the effectiveness of the rule and make it more CPU efficient.
> IE once
> you've found at least 10 consecutive pseudo-tags do you care if there
> are more
> than 10 (since you're not looking for anything specific after the
> match nor
> doing anything with knowing the exact number of them).
Good point. Changed.
regards,
KAM
Re: Help with a regex to catch spam with gibberish html tags
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Thu, 30 Jan 2014, Amir Caspi wrote:
> On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KM...@PCCC.com> wrote:
>
> If you want to share the complete rule, I can throw it into my sandbox and see what masscheck thinks as well.
>
>
> The complete rule would be something like this, assuming Andy implemented it as I wrote it:
>
> rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}/
> describe HTML_NONSENSE_TAGS Many consecutive multi-letter HTML tags, likely nonsense/spam
> score HTML_NONSENSE_TAGS 0.001
Actually that unbounded {10,} repeat can be written as an explicit {10} with out
reducing the effectiveness of the rule and make it more CPU efficient. IE once
you've found at least 10 consecutive pseudo-tags do you care if there are more
than 10 (since you're not looking for anything specific after the match nor
doing anything with knowing the exact number of them).
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Help with a regex to catch spam with gibberish html tags
Posted by Amir Caspi <ce...@3phase.com>.
On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KM...@PCCC.com> wrote:
> If you want to share the complete rule, I can throw it into my sandbox and see what masscheck thinks as well.
The complete rule would be something like this, assuming Andy implemented it as I wrote it:
rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}/
describe HTML_NONSENSE_TAGS Many consecutive multi-letter HTML tags, likely nonsense/spam
score HTML_NONSENSE_TAGS 0.001
Score to be adjusted as needed, of course.
If one wants to be even more explicit, one could require that the tags be prefaced with a <style> tag, although that should, hopefully, get picked up by John Hardin's modifications to STYLE_GIBBERISH sometime in the near future.
Cheers.
--- Amir
Re: Help with a regex to catch spam with gibberish html tags
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 1/30/2014 11:23 AM, Andy Jezierski wrote:
> Amir Caspi <ce...@3phase.com> wrote on 01/29/2014 11:08:18 AM:
>
> > From: Amir Caspi <ce...@3phase.com>
> > To: Andy Jezierski <AJ...@stepan.com>,
> > Cc: "users@spamassassin.apache.org" <us...@spamassassin.apache.org>
> > Date: 01/29/2014 11:08 AM
> > Subject: Re: Help with a regex to catch spam with gibberish html tags
> >
> > On Jan 29, 2014, at 9:53 AM, "Andy Jezierski"
> <AJ...@stepan.com> wrote:
>
> > I've been noticing a lot of spam getting through with the same
> > traits, a bunch of random words within brackets. They all seem to
> > come after the </body> or the </html> tag. Anyone much more
> > knowledgeable than me care to assist with a rule to detect them?
> >
> > What about something like:
> >
> > rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}
> >
> > This will hit on 10 or more consecutive tags separated by nothing
> > but white space. Only single-word tags will hit, so this should
> > minimize FPs from heavy formatting such as nested divs.
> >
> > Completely untested, use at your own risk (but post back and tell us
> > how well it worked).
> >
> > --- Amir
> > thumbed via iPhone
>
> That rule seems to be working fine. Has hit on every one of those
> pesky messages so far with no FP's. Will let it run for a while longer
> before I bump up the score.
If you want to share the complete rule, I can throw it into my sandbox
and see what masscheck thinks as well.
regards,
KAM
Re: Help with a regex to catch spam with gibberish html tags
Posted by Andy Jezierski <AJ...@stepan.com>.
Amir Caspi <ce...@3phase.com> wrote on 01/29/2014 11:08:18 AM:
> From: Amir Caspi <ce...@3phase.com>
> To: Andy Jezierski <AJ...@stepan.com>,
> Cc: "users@spamassassin.apache.org" <us...@spamassassin.apache.org>
> Date: 01/29/2014 11:08 AM
> Subject: Re: Help with a regex to catch spam with gibberish html tags
>
> On Jan 29, 2014, at 9:53 AM, "Andy Jezierski" <AJ...@stepan.com>
wrote:
> I've been noticing a lot of spam getting through with the same
> traits, a bunch of random words within brackets. They all seem to
> come after the </body> or the </html> tag. Anyone much more
> knowledgeable than me care to assist with a rule to detect them?
>
> What about something like:
>
> rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}
>
> This will hit on 10 or more consecutive tags separated by nothing
> but white space. Only single-word tags will hit, so this should
> minimize FPs from heavy formatting such as nested divs.
>
> Completely untested, use at your own risk (but post back and tell us
> how well it worked).
>
> --- Amir
> thumbed via iPhone
That rule seems to be working fine. Has hit on every one of those pesky
messages so far with no FP's. Will let it run for a while longer before I
bump up the score.
Thanks
Andy
Re: Help with a regex to catch spam with gibberish html tags
Posted by Amir Caspi <ce...@3phase.com>.
> On Jan 29, 2014, at 9:53 AM, "Andy Jezierski" <AJ...@stepan.com> wrote:
>
> I've been noticing a lot of spam getting through with the same traits, a bunch of random words within brackets. They all seem to come after the </body> or the </html> tag. Anyone much more knowledgeable than me care to assist with a rule to detect them?
What about something like:
rawbody HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10,}
This will hit on 10 or more consecutive tags separated by nothing but white space. Only single-word tags will hit, so this should minimize FPs from heavy formatting such as nested divs.
Completely untested, use at your own risk (but post back and tell us how well it worked).
--- Amir
thumbed via iPhone
Re: Help with a regex to catch spam with gibberish html tags
Posted by Andy Jezierski <AJ...@stepan.com>.
John Hardin <jh...@impsec.org> wrote on 01/29/2014 12:34:29 PM:
> From: John Hardin <jh...@impsec.org>
> To: users@spamassassin.apache.org,
> Date: 01/29/2014 12:35 PM
> Subject: Re: Help with a regex to catch spam with gibberish html tags
>
> On Wed, 29 Jan 2014, Joe Quinn wrote:
>
> > On 1/29/2014 11:53 AM, Andy Jezierski wrote:
> >> I've been noticing a lot of spam getting through with the same
traits, a
> >> bunch of random words within brackets. They all seem to come after
the
> >> </body> or the </html> tag. Anyone much more knowledgeable than me
care
> >> to assist with a rule to detect them?
> >>
> >> Example:
> >>
> >> </html>
> >>
> >> </body>
> >> <style>
> >> <geehrter>
> >> <convaincre>
> >> <eingerichtet>
> >> <piuttosto>
> >> <meny>
>
> ...etc snipped.
>
> > I've been seeing that as well. They seem to all begin with <style>as
well,
> > to keep that crap from going through mail client HTML parsers.
> >
> > You can probably exploit the fact that nobody is ever going to
> write a style
> > block that doesn't match /[{}]/, but I haven't been able to experiment
yet
> > with any rules.
>
> There is already a style gibberish rule.
>
>
http://ruleqa.spamassassin.org/20140128-r1562007-n/STYLE_GIBBERISH/detail
>
I've seen the STYLE_GIBBERISH rule hit on a number of messages, but never
on this type of spam.
Re: Help with a regex to catch spam with gibberish html tags
Posted by John Hardin <jh...@impsec.org>.
On Wed, 29 Jan 2014, Amir 'CG' Caspi wrote:
> On Wed, January 29, 2014 11:34 am, John Hardin wrote:
>> There is already a style gibberish rule.
>
> It would appear that the rule needs updating based on the above examples...
Okay, I will try to take a look at it this weekend. Thanks.
Feel free to email me spamples as RFC822 attachments if you like, pastebin
does expire stuff.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A man can never have too much red wine, too many books, or too
much ammunition. -- Rudyard Kipling
-----------------------------------------------------------------------
3 days until the 11st anniversary of the loss of STS-107 Columbia
Re: Help with a regex to catch spam with gibberish html tags
Posted by Amir 'CG' Caspi <ce...@3phase.com>.
On Wed, January 29, 2014 11:34 am, John Hardin wrote:
> There is already a style gibberish rule.
>
> http://ruleqa.spamassassin.org/20140128-r1562007-n/STYLE_GIBBERISH/detail
I haven't seen STYLE_GIBBERISH hitting on very much in the last month...
some hits, but it's missing a bunch of stuff, including this exact example
and some similar ones. For example:
http://pastebin.com/5FERHxfD
This is exactly like what the previous poster mentioned... it fails to hit
the rule, unfortunately.
Another (different) example:
http://pastebin.com/eJVQyeFy
See the <style> tag near the very end, which is definitely gibberish but
did not hit the rule. (I wonder if we should also make a TITLE_TOO_LONG
rule, for <title> tags whose content exceeds a few hundred characters...
that should never be legitimate. Probably should also include an
ALT_TOO_LONG rule, for alt attributes of img/area/whatever tags... I've
seen a bunch of gibberish embedded in alt attributes lately.)
And another different type of non-hitting spample:
http://pastebin.com/9U7KwCtA
Note the style tag at the end, filled with commented HTML... this is
itself gibberish (long HTML comment for no reason) but is also invalid
within the style tag. But, again, did not hit the rule. (I have a number
of these types of spams, the content and layout of the HTML comment
differs but the idea is the same.)
It would appear that the rule needs updating based on the above examples...
Cheers.
--- Amir
Re: Help with a regex to catch spam with gibberish html tags
Posted by John Hardin <jh...@impsec.org>.
On Wed, 29 Jan 2014, Joe Quinn wrote:
> On 1/29/2014 11:53 AM, Andy Jezierski wrote:
>> I've been noticing a lot of spam getting through with the same traits, a
>> bunch of random words within brackets. They all seem to come after the
>> </body> or the </html> tag. Anyone much more knowledgeable than me care
>> to assist with a rule to detect them?
>>
>> Example:
>>
>> </html>
>>
>> </body>
>> <style>
>> <geehrter>
>> <convaincre>
>> <eingerichtet>
>> <piuttosto>
>> <meny>
...etc snipped.
> I've been seeing that as well. They seem to all begin with <style> as well,
> to keep that crap from going through mail client HTML parsers.
>
> You can probably exploit the fact that nobody is ever going to write a style
> block that doesn't match /[{}]/, but I haven't been able to experiment yet
> with any rules.
There is already a style gibberish rule.
http://ruleqa.spamassassin.org/20140128-r1562007-n/STYLE_GIBBERISH/detail
> I wouldn't recommend going the more general route of counting invalid HTML
> tags, simply due to the enormity of trying to maintain such a rule over time.
Not in a rule certainly. That would be more proper in a plugin. Agreed
that maintenance of the list of valid hTML tags would be an ongoing issue
unless the list is available in machine-parseable form somewhere and a
code generator based on that is used to support the plugin.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Maxim IX: Never turn your back on an enemy.
-----------------------------------------------------------------------
3 days until the 11st anniversary of the loss of STS-107 Columbia
Re: Help with a regex to catch spam with gibberish html tags
Posted by Joe Quinn <jq...@pccc.com>.
On 1/29/2014 11:53 AM, Andy Jezierski wrote:
> I've been noticing a lot of spam getting through with the same traits,
> a bunch of random words within brackets. They all seem to come after
> the </body> or the </html> tag. Anyone much more knowledgeable than
> me care to assist with a rule to detect them?
>
> Thanks
> Andy
>
>
> Example:
>
> </html>
>
> </body>
> <style>
> <geehrter>
> <convaincre>
> <eingerichtet>
> <piuttosto>
> <meny>
> <Aufl>
> <quilting>
>
>
> <surveymonkey>
> <update>
> <Benoit>
> <problemi>
> <ese>
> <telstra>
> <checking>
> <aglow>
> <insegna>
> <doorgeven>
I've been seeing that as well. They seem to all begin with <style> as
well, to keep that crap from going through mail client HTML parsers.
You can probably exploit the fact that nobody is ever going to write a
style block that doesn't match /[{}]/, but I haven't been able to
experiment yet with any rules.
I wouldn't recommend going the more general route of counting invalid
HTML tags, simply due to the enormity of trying to maintain such a rule
over time.