Pipe html stripped email thru spamc twice

Kevin Brouelette kevin1a at VARLOG.NET
Thu Apr 15 06:09:45 IST 2004


Hello

I've been seeing some well crafted spams that slip thru spamassassin.
 The spammer seems to break up the body by using a lot
of html tags to hide his message.

Today, one of them had a section like this  The top line read:

Deer Antler Pl+us
-----------------
But the email source code shows:

<h2><u><font color=3D"#FF0000" face=3D"Arial">Deer Antler Pl<font style=
=3Dfont-size:1px>+</font>us</font></u></h2>
-----------------------------------------------------------------------

 This particular spam rated 0.4 by Spamassassin.
My question,  is it possible to have mailscanner take the stripped html
emails and then re-run them thru spamc again to try to catch this type of spam?
It this allready the current process that MS strips html 1st and then calls spamc?
-or- Would it even help since the stripped email still comes thru with lines like this
after the html is stripped:

F:ind out More H*ere

Thanks in advance.

Kevin B



More information about the MailScanner mailing list