You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by DEFFONTAINES Vincent <Vi...@coe.int> on 2004/02/19 16:33:06 UTC
Tiny font
Below is the content of a spam I just received.
It has a very small font (font size = 1), that includes a bunch of words
probably meant to confuse filters.
I quickly searched, and couldn't find any spamassassin rule (running 2.63
debian package here) matching tiny fonts.
Just thinking it might score a point or two..
Vincent
<< JUNK MAIL BELOW >>
<html>
<body>
Is your pers<font style="font-size: 1;">q</font>onal inform<font
style="font-size: 1;">t</font>ation safe? You might be surp<font
style="font-size: 1;">h</font>rised by the<br>
answer. Bo<font style="font-size: 1;">r</font>ost your secu<font
style="font-size: 1;">n</font>rity - and your peace of mind - with Iden<font
style="font-size: 1;">x</font>tity<br>
Th<chlorophyll>eft Prot</aster>ector; the most comprehensive
soft<metcalf>ware pro</mobile>duct designed<br>
specif<academe>ically to help you pro</hornblende>tect against and
reco<harpy>ver from the c</homeomorph>rime of<br>
ide<britain>ntity the</actaeon>ft. Are you aw<flak>are that:<br>
<br>
# Iden</dew>tity the<northwestern>ft is the #1 fra</paragon>ud
comp<courtroom>laint - Fede</briefcase>ral Trade Commission<br>
# 5.5% of Americans have already fallen victim to ide<coverlet>ntity
fra</pitchstone>ud - St<line>ar Sy</serpentine>stems<br>
# Vic<discussant>tims spe</knives>nd an ave<infima>rage of 175 hours and
$800 in out-of</retinal>-pocket<br>
expe<geochronology>nses to clear their names - Privacy Rights
Cleari</chivalry>nghouse and the<br>
Fed<macdonald>eral Tr</pussy>ade Commis<gonzales>sion<br>
Don't go another day without prote</heap>cting yourself.<br>
<a href="http://www.seeitnowquickly.net/s/?AFF_ID=s0209">
Ge<font style="font-size: 1;">v</font>t it now!</a>
<br><br><br><br><br><br><br><br><br><br>
rem at www.seeitnowquickly.net<br>
<font style="font-size: 1;">asynchrony further fair dam frost adelaide
confucius crosby paraphernalia decontrol implore ain't component piece
excrescent glide erlenmeyer pelvic enfant hawk adamant cobble instructor
heartbeat goldsmith existential
side fro rockford aden gigahertz curtain earphone sarcophagus gyroscope
coastal oppose aspartic marco mission blomquist humidify adriatic elfin
kathleen bean caramel aphorism authoritarian <br>
first prod cadent desecrater gorham mutate earth bandage hubbell planetoid
garlic luxuriate he greenwood pyhrric poseidon dostoevsky airy <br>
bracket dally rapprochement prometheus chang combustion ilona kava dillon
jones sharpe hearty pianissimo emblematic farrell dud paregoric
brainchildren bestirring agitate eosine gyro inhibitory gorham farley axon
gibe <br>
deploy cherry schoolbook gurkha champaign chiton constrain erudition
adventure ecosystem instable hereunder geoffrey admiration <br>
chancy gauche obtain gogh aaron aisle nucleoli aghast janeiro aba edison
calibre goldenseal eelgrass linger downwind pediatric mahoney freed beseech
megaton astronomer genii nuptial <br>
conn fran eileen orgy german cbs auction eyebright digitalis inspect lavish
<br>
downright gallus emporium empire incommutable caiman jenkins accolade bidden
contaminate blackberry brewery shorten aroma orthodox atlantis aforethought
coachwork appellant prolong recline apollonian jolt bumble libya inferring
libel betrothal ketosis catapult nasa <br>
efface antigorite dose shinbone seepage evergreen gripe clutter fogy
mendelssohn picasso betelgeuse imitable qualm <br>
apr cavitate accost abominate bailey freya enigmatic pinkie causal evzone
abbas satiric exasperater bracken attempt beaujolais open prizewinning
filament lamellar fink gustafson bipolar <br>
insolent ellen ambulant alexis muzzle campion flue canoga bewail continuo
clearheaded responsive bassinet chauffeur annular christoffel dobbin copter
mollie sediment hydrangea effectuate carmen <br>
braid initial nikolai apocalypse append retardation asphyxiate desert daniel
doorbell growl fairgoer <br>
chase noaa glad dipole sawdust bengal drippy anthropomorphic aggressor
colloq hadn't fed chisholm burro monic backdrop hertzog dallas <br>
freshmen reimbursable binge crucial ambrosia meadowsweet harlan dusky
acerbic breakfast diagnosis <br>
forgetting dragnet furry o'donnell pulsar ascetic archaism cuny honeycomb
core guiding aleph rutile forbade nighttime salad longish hireling
compatriot landis keaton <br>
earthshaking addendum populace alhambra impedance patton dud kermit hedge
karma erik histogram segundo elsevier extravagant estuarine bag roman patina
circe expedite bibliophile authoritative mastermind offend arrow chrysler
foxtail rogue campsite roadway ergative boltzmann bunch egotist decelerate
filial bismark <br>
aspen delimit incite downstate consultation morphophonemic barrymore dog
birmingham coronet pollutant elkhart assassinate activation clientele
polarography <br>
affricate dolly amiss hippodrome pigmentation bongo counterpoise frustrater
amelia honduras igor chlorate hahn hereinbelow floe manse balky salesian
lachesis expressible glutton mylar frost shad gloat bogus clean haydn larsen
gogh amphibole normal clatter penitential necktie anaheim ganymede cremate
<br>
repetitive baroness brett celluloid lunchroom disruption imprison
predisposition coulomb darlene glycerine electret actinium shadow belch
coffman <br>
rhubarb amoco itinerant pigpen contrary beetle bile boisterous contain balmy
oatmeal pushout roland merlin greenbriar dougherty bohemia geocentric lounge
gibbous calcutta dazzle express flintlock sardonic apport guilford biconcave
hodges fount permissible gonzales honshu chalkboard borough bradbury prompt
chivalry brochure <br>
homily aback hard calcine external deerskin oilcloth insecure feminist abuse
bituminous malraux forward patrol bloodstream gigabyte amidst briggs clone
brethren hatchway eat <br>
electoral ignoramus dye hygiene closet flautist lubricious pitilessly index
nevertheless jargon milestone filch courtney focal lou lettuce goodwill
convulsive coerce bruce siena loeb <br>
angiosperm numb revise perfume bile crucifixion academic headwall sir fig
distinguish canvasback galaxy denotation adler caiman gryphon bini lifespan
benefactor hoboken demystify knead <br>
adenine alpha incomparable manumitted babysit hicks cap rustproof goose
bettor depend flannel evocable bestirring cady cuddle precess georgetown
glenda bipartisan dung barefaced rarefy catkin fracture gladiator between
glitter nay drift cabinet homicidal candelabra famish boathouse decompress
chaperone pathway <br>
assurance evidential greater daddy fruition augend evasion osmosis alkali
goff informative beatific ideate confocal debra atop bess nocturne shrug
adamant claustrophobic <br>
claire dally decollimate lookout shut apprehension shun dialect lamp bandage
iodinate parolee escadrille matroid centerpiece converge pocus conservative
contumacy prolate <br>
financier induce reparation aggression rafael fauna bruno bundestag
monetarism shiplap phenomena couldn't shunt numerable aegis frederic duchess
harcourt bisque inappeasable egalitarian minute dodson conjuncture approach
ardency battelle chancel brave <br>
newton citizen deficient disquisition matron erlenmeyer berlioz romp millard
employing ma first marimba hough anaerobic bamboo redshank cabbage ideologue
diverge conciliate coin cozen cascade frazzle guise bird decree prerogative
edge popular cuprous pluggable seventeenth gourd injure backlash capacious
casino canna <br>
inspiration bellman buttery church dictum baxter devil besmirch knit gestalt
gird don't chateaux eloquent asymmetry beloit integument globulin contusion
pig enthusiast hydrophobic </font>
</body>
</html>
Re: Tiny font
Posted by Loren Wilton <lw...@earthlink.net>.
> Below is the content of a spam I just received.
> It has a very small font (font size = 1), that includes a bunch of words
> probably meant to confuse filters.
>
> I quickly searched, and couldn't find any spamassassin rule (running 2.63
> debian package here) matching tiny fonts.
> Just thinking it might score a point or two..
I use
#catch one case of tiny fonts
rawbody TINY_FONT_1 /\<.*font\-size\:[ \"]*1[^0-9]+.*\>/i
describe TINY_FONT_1 Body contains 1pt font
score TINY_FONT_1 10
rawbody TINY_FONT_0 /\<.*font\-size\:[ \"]*0[^0-9]+.*\>/i
describe TINY_FONT_0 Body contains 0pt font
score TINY_FONT_0 10
Loren
Re: [spa] Re: Tiny font
Posted by "Brent J. Nordquist" <b-...@bethel.edu>.
On Thu, 19 Feb 2004, Charles Gregory <cg...@hwcn.org> wrote:
> I notice you don't use the quote (").
Not only that, but you probably want to drop the style= part too. The
spammer can use CSS form:
<style type="text/css">
<!--
.body {font-family: Arial, Helvetica, sans-serif; font-size: 0px;}
[...]
</style>
http://marc.theaimsgroup.com/?l=spamassassin-users&m=107478244029705&w=2
--
Brent J. Nordquist <b-...@bethel.edu> N0BJN
Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html
Re: [spa] Re: Tiny font
Posted by Charles Gregory <cg...@hwcn.org>.
On Thu, 19 Feb 2004, Berend De Schouwer wrote:
> rawbody MK_HTML_TINY /\<font style=[a-z\-]*size:1px\>/i
> describe MK_HTML_TINY Unreadably small font.
> score MK_HTML_TINY 2.0
There are actually 0px and 0/1pt versions of this trick. And is not always
in a 'font'. My rule has evolved to:
rawbody LOC_HTMLINVISTEXTZERO /style="[^>"]*font-size: *[01]p[tx]/i
describe LOC_HTMLINVISTEXTZERO invisible text - zero point
score LOC_HTMLINVISTEXTZERO 1.8
I notice you don't use the quote ("). I also note that the spam you quote
is just using 'size: 1;' without the pt/px.
The game goes on.....
- Charles
Re: Tiny font
Posted by Berend De Schouwer <bd...@jhb.ucs.co.za>.
On Thursday 19 February 2004 17:33, DEFFONTAINES Vincent wrote:
> Below is the content of a spam I just received.
> It has a very small font (font size = 1), that includes a bunch of
> words probably meant to confuse filters.
>
> I quickly searched, and couldn't find any spamassassin rule (running
> 2.63 debian package here) matching tiny fonts.
> Just thinking it might score a point or two..
I use this. You'll have to modify it a bit, though. Try \s*1(px)?
instead of :1px.
rawbody MK_HTML_TINY /\<font style=[a-z\-]*size:1px\>/i
describe MK_HTML_TINY Unreadably small font.
score MK_HTML_TINY 2.0
> Vincent
>
>
> << JUNK MAIL BELOW >>
>
>
>
>
>
>
>
>
>
>
>
> <html>
> <body>
> Is your pers<font style="font-size: 1;">q</font>onal inform<font
> style="font-size: 1;">t</font>ation safe? You might be surp<font
> style="font-size: 1;">h</font>rised by the<br>
> answer. Bo<font style="font-size: 1;">r</font>ost your secu<font
> style="font-size: 1;">n</font>rity - and your peace of mind - with
> Iden<font style="font-size: 1;">x</font>tity<br>
> Th<chlorophyll>eft Prot</aster>ector; the most comprehensive
> soft<metcalf>ware pro</mobile>duct designed<br>
> specif<academe>ically to help you pro</hornblende>tect against and
> reco<harpy>ver from the c</homeomorph>rime of<br>
> ide<britain>ntity the</actaeon>ft. Are you aw<flak>are that:<br>
> <br>
> # Iden</dew>tity the<northwestern>ft is the #1 fra</paragon>ud
> comp<courtroom>laint - Fede</briefcase>ral Trade Commission<br>
> # 5.5% of Americans have already fallen victim to ide<coverlet>ntity
> fra</pitchstone>ud - St<line>ar Sy</serpentine>stems<br>
> # Vic<discussant>tims spe</knives>nd an ave<infima>rage of 175 hours
> and $800 in out-of</retinal>-pocket<br>
> expe<geochronology>nses to clear their names - Privacy Rights
> Cleari</chivalry>nghouse and the<br>
> Fed<macdonald>eral Tr</pussy>ade Commis<gonzales>sion<br>
>
> Don't go another day without prote</heap>cting yourself.<br>
> <a href="http://www.seeitnowquickly.net/s/?AFF_ID=s0209">
> Ge<font style="font-size: 1;">v</font>t it now!</a>
> <br><br><br><br><br><br><br><br><br><br>
> rem at www.seeitnowquickly.net<br>
> <font style="font-size: 1;">asynchrony further fair dam frost
> adelaide confucius crosby paraphernalia decontrol implore ain't
> component piece excrescent glide erlenmeyer pelvic enfant hawk
> adamant cobble instructor heartbeat goldsmith existential
> side fro rockford aden gigahertz curtain earphone sarcophagus
> gyroscope coastal oppose aspartic marco mission blomquist humidify
> adriatic elfin kathleen bean caramel aphorism authoritarian <br>
> first prod cadent desecrater gorham mutate earth bandage hubbell
> planetoid garlic luxuriate he greenwood pyhrric poseidon dostoevsky
> airy <br> bracket dally rapprochement prometheus chang combustion
> ilona kava dillon jones sharpe hearty pianissimo emblematic farrell
> dud paregoric brainchildren bestirring agitate eosine gyro inhibitory
> gorham farley axon gibe <br>
> deploy cherry schoolbook gurkha champaign chiton constrain erudition
> adventure ecosystem instable hereunder geoffrey admiration <br>
> chancy gauche obtain gogh aaron aisle nucleoli aghast janeiro aba
> edison calibre goldenseal eelgrass linger downwind pediatric mahoney
> freed beseech megaton astronomer genii nuptial <br>
> conn fran eileen orgy german cbs auction eyebright digitalis inspect
> lavish <br>
> downright gallus emporium empire incommutable caiman jenkins accolade
> bidden contaminate blackberry brewery shorten aroma orthodox atlantis
> aforethought coachwork appellant prolong recline apollonian jolt
> bumble libya inferring libel betrothal ketosis catapult nasa <br>
> efface antigorite dose shinbone seepage evergreen gripe clutter fogy
> mendelssohn picasso betelgeuse imitable qualm <br>
> apr cavitate accost abominate bailey freya enigmatic pinkie causal
> evzone abbas satiric exasperater bracken attempt beaujolais open
> prizewinning filament lamellar fink gustafson bipolar <br>
> insolent ellen ambulant alexis muzzle campion flue canoga bewail
> continuo clearheaded responsive bassinet chauffeur annular
> christoffel dobbin copter mollie sediment hydrangea effectuate carmen
> <br>
> braid initial nikolai apocalypse append retardation asphyxiate desert
> daniel doorbell growl fairgoer <br>
> chase noaa glad dipole sawdust bengal drippy anthropomorphic
> aggressor colloq hadn't fed chisholm burro monic backdrop hertzog
> dallas <br> freshmen reimbursable binge crucial ambrosia meadowsweet
> harlan dusky acerbic breakfast diagnosis <br>
> forgetting dragnet furry o'donnell pulsar ascetic archaism cuny
> honeycomb core guiding aleph rutile forbade nighttime salad longish
> hireling compatriot landis keaton <br>
> earthshaking addendum populace alhambra impedance patton dud kermit
> hedge karma erik histogram segundo elsevier extravagant estuarine bag
> roman patina circe expedite bibliophile authoritative mastermind
> offend arrow chrysler foxtail rogue campsite roadway ergative
> boltzmann bunch egotist decelerate filial bismark <br>
> aspen delimit incite downstate consultation morphophonemic barrymore
> dog birmingham coronet pollutant elkhart assassinate activation
> clientele polarography <br>
> affricate dolly amiss hippodrome pigmentation bongo counterpoise
> frustrater amelia honduras igor chlorate hahn hereinbelow floe manse
> balky salesian lachesis expressible glutton mylar frost shad gloat
> bogus clean haydn larsen gogh amphibole normal clatter penitential
> necktie anaheim ganymede cremate <br>
> repetitive baroness brett celluloid lunchroom disruption imprison
> predisposition coulomb darlene glycerine electret actinium shadow
> belch coffman <br>
> rhubarb amoco itinerant pigpen contrary beetle bile boisterous
> contain balmy oatmeal pushout roland merlin greenbriar dougherty
> bohemia geocentric lounge gibbous calcutta dazzle express flintlock
> sardonic apport guilford biconcave hodges fount permissible gonzales
> honshu chalkboard borough bradbury prompt chivalry brochure <br>
> homily aback hard calcine external deerskin oilcloth insecure
> feminist abuse bituminous malraux forward patrol bloodstream gigabyte
> amidst briggs clone brethren hatchway eat <br>
> electoral ignoramus dye hygiene closet flautist lubricious pitilessly
> index nevertheless jargon milestone filch courtney focal lou lettuce
> goodwill convulsive coerce bruce siena loeb <br>
> angiosperm numb revise perfume bile crucifixion academic headwall sir
> fig distinguish canvasback galaxy denotation adler caiman gryphon
> bini lifespan benefactor hoboken demystify knead <br>
> adenine alpha incomparable manumitted babysit hicks cap rustproof
> goose bettor depend flannel evocable bestirring cady cuddle precess
> georgetown glenda bipartisan dung barefaced rarefy catkin fracture
> gladiator between glitter nay drift cabinet homicidal candelabra
> famish boathouse decompress chaperone pathway <br>
> assurance evidential greater daddy fruition augend evasion osmosis
> alkali goff informative beatific ideate confocal debra atop bess
> nocturne shrug adamant claustrophobic <br>
> claire dally decollimate lookout shut apprehension shun dialect lamp
> bandage iodinate parolee escadrille matroid centerpiece converge
> pocus conservative contumacy prolate <br>
> financier induce reparation aggression rafael fauna bruno bundestag
> monetarism shiplap phenomena couldn't shunt numerable aegis frederic
> duchess harcourt bisque inappeasable egalitarian minute dodson
> conjuncture approach ardency battelle chancel brave <br>
> newton citizen deficient disquisition matron erlenmeyer berlioz romp
> millard employing ma first marimba hough anaerobic bamboo redshank
> cabbage ideologue diverge conciliate coin cozen cascade frazzle guise
> bird decree prerogative edge popular cuprous pluggable seventeenth
> gourd injure backlash capacious casino canna <br>
> inspiration bellman buttery church dictum baxter devil besmirch knit
> gestalt gird don't chateaux eloquent asymmetry beloit integument
> globulin contusion pig enthusiast hydrophobic </font>
> </body>
> </html>
--
Berend De Schouwer
Re: AOL And sa problems
Posted by Raquel Rice <ra...@thericehouse.net>.
On Thu, 19 Feb 2004 11:49:08 -0800
Kelson Vibber <ke...@speed.net> wrote:
> At 07:44 AM 2/19/2004, Matt wrote:
> >3.0 NO_RDNS_DOTCOM_HELO
> >and
> >1.9 FAKE_HELO_AOL
>
> This was discussed a lot over the last few days. Consensus was
> DNS timeouts. If you don't have one already, put a caching DNS
> server on the same computer that's running SpamAssassin, and that
> should stop or at least reduce the problem.
>
>
> Kelson Vibber
That could be why I'm not seeing any of those problems, I have a
caching DNS server?
--
Raquel
============================================================
The world acquires value only through its extremes and endures only
through moderation; extremists make the world great, the moderates
give it stability.
--Paul Valery
Re: AOL And sa problems
Posted by Kelson Vibber <ke...@speed.net>.
At 07:44 AM 2/19/2004, Matt wrote:
>3.0 NO_RDNS_DOTCOM_HELO
>and
>1.9 FAKE_HELO_AOL
This was discussed a lot over the last few days. Consensus was DNS
timeouts. If you don't have one already, put a caching DNS server on the
same computer that's running SpamAssassin, and that should stop or at least
reduce the problem.
Kelson Vibber
SpeedGate Communications <www.speed.net>
AOL And sa problems
Posted by Matt <qm...@chilitech.com>.
Greetings,
Alot of e-mail coming from AOL.com addresses is being marked as spam.
When I check the reason why it says:
3.0 NO_RDNS_DOTCOM_HELO
and
1.9 FAKE_HELO_AOL
What are the reasons for this? As far as I can tell the helo doesn't
seem fake? And the reverse DNS does seem to match. Now not all of my
AOL incoming mail is being marked this way.. but alot of it is.
I'm running qmail with spamassassin 2.60
~ Matt