You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Todd Ellison <to...@venturenet.net> on 2005/04/07 19:44:45 UTC
Tables obscuring words
Hi all.
I have seen several spammers lately using tables to obscure offensive
words in the message body. Most of them get caught by other tests, but
some get through. Do you guys have any ideas for rules to check this?
(Example table source below)
Thanks
Todd
---------------Begin example----------------
<TABLE cellSpacing=0 cellPadding=0 border=0>
<TBODY>
<TR vAlign=bottom>
<TD rowSpan=2><font face="Arial" style="font-size:
13pt">Exp</font></TD>
<TD> </TD>
<TD rowSpan=2><FONT face=Arial style="font-size:
13pt"> and En</FONT></TD>
<TD> </TD>
<TD rowSpan=2><FONT face=Arial style="font-size: 13pt"> your
Pen</FONT></TD>
<TD> </TD>
<TD rowSpan=2><FONT face=Arial style="font-size:
13pt"> with </FONT></TD>
<TD> </TD>
<TD rowSpan=2><font face="Arial" style="font-size: 13pt">largement
p</font></TD>
<TD rowSpan=2><FONT face=Arial style="font-size:
13pt">ill </FONT></TD>
<TD> </TD>
<TR>
<TD><font face="Arial" style="font-size: 13pt">and</font></TD>
<TD><font face="Arial" style="font-size: 13pt">large</font></TD>
<TD><font face="Arial" style="font-size: 13pt">is</font></TD>
<TD><font face="Arial" style="font-size: 13pt">our en</font></TD>
<TD> </TD></TR></TBODY></TABLE>
Re: Tables obscuring words
Posted by Jesse Houwing <j....@rulesemporium.com>.
>> See yesterday's thread "Re: Extra Sare Rules for meds?"
>>
>> Jesse Houwing posted a beta-grade rule for this:
>>
>> BODY TABLEOBFU
>> m{<td([^>]+|"[^"]+)>(<([^>]+|"[^"]+)>)*[a-z]{1,2}(<([^>]+|"[^"]+)>)*</td([^>]+|"[^"]+)>}i
>>
>>
>>
> Argh. I hate when I do that. Looks like I just stopped reading that
> thread too early. This apparently doesn't hit on my sample yet, but
> with tweakage it might. Working on that now.
I must have been half asleep yesterday ;)
It took me a bit of basic tweaking, but this one seems to do it's jon. I
have yet to finish my masscheck, but let's see how this does:
RAWBODY TABLEOBFU
/<td([^>]|"[^"]*"|'[^']*')*>(<([^>]|"[^"]*"|'[^']*')*>)*[a-z]{1,2}(<([^>]|"[^"]*"|'[^']*')*>)*<\/td([^>]|"[^"]*"|'[^']*')*>/i
SCORE TABLEOBFU 2
Jesse
Re: Tables obscuring words
Posted by Todd Ellison <to...@venturenet.net>.
Matt Kettler wrote:
> See yesterday's thread "Re: Extra Sare Rules for meds?"
>
>Jesse Houwing posted a beta-grade rule for this:
>
>BODY TABLEOBFU
>m{<td([^>]+|"[^"]+)>(<([^>]+|"[^"]+)>)*[a-z]{1,2}(<([^>]+|"[^"]+)>)*</td([^>]+|"[^"]+)>}i
>
>
Argh. I hate when I do that. Looks like I just stopped reading that
thread too early. This apparently doesn't hit on my sample yet, but
with tweakage it might. Working on that now.
Todd
Re: Tables obscuring words
Posted by Matt Kettler <mk...@evi-inc.com>.
Todd Ellison wrote:
> Hi all.
>
> I have seen several spammers lately using tables to obscure offensive
> words in the message body. Most of them get caught by other tests,
> but some get through. Do you guys have any ideas for rules to check
> this? (Example table source below)
See yesterday's thread "Re: Extra Sare Rules for meds?"
Jesse Houwing posted a beta-grade rule for this:
BODY TABLEOBFU
m{<td([^>]+|"[^"]+)>(<([^>]+|"[^"]+)>)*[a-z]{1,2}(<([^>]+|"[^"]+)>)*</td([^>]+|"[^"]+)>}i