HTML Table SPAM?

[Matt Kettler]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Devon Harding wrote:

>Has any seen these kind of SPAM passing through?  Where the SPAMMER
>would use HTML tables to separate the offensive content?  The words
>looks clear when received, but every two letters are separated by a
>table.
>

I've seen several of these, mostly in drug spams. Apparently now that
antidrug is in SA 3.0 they are trying to evade those rules.

Strangely, those messages are still getting tagged, mostly by razor and
SURBL rules as they still have links to a website..

The most recent example got hit by razor, a weak hit from bayes, and a
lot of DNSBLs of the relay (tweaked SA 2.64):

score=16.199, required 5,    BAYES_60 1.59, HTML_60_70 0.11,
HTML_FONT_BIG 0.27,    HTML_MESSAGE 0.10,
INFO_GREYLIST_NOTDELAYED -0.01,    MSGID_FROM_MTA_SHORT 1.00,
PRIORITY_NO_NAME 1.21,    RAZOR2_CF_RANGE_51_100 0.20,
RAZOR2_CHECK 1.05,    RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71,
RCVD_IN_NJABL_PROXY 2.34,
RCVD_IN_SORBS_HTTP 1.20,    RCVD_IN_SORBS_MISC 0.00, RCVD_IN_XBL 4.92


So, while I've seen them, I have yet to get a FN on one.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!