HTML Table SPAM?

[Devon Harding]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Here is my RBL's and they still seem to get through.  What can I do to stop em'?

Spam List = dslb.org ORDB-RBL SBL+XBL spamhaus.org spamhaus-XBL
spamcop.net NJABL CBL RSL DSBL SORBS-SPAM SURBL


On Mon, 28 Mar 2005 13:55:49 -0500, Matt Kettler <mkettler at evi-inc.com> wrote:
> Devon Harding wrote:
>
> >Has any seen these kind of SPAM passing through?  Where the SPAMMER
> >would use HTML tables to separate the offensive content?  The words
> >looks clear when received, but every two letters are separated by a
> >table.
> >
>
> I've seen several of these, mostly in drug spams. Apparently now that
> antidrug is in SA 3.0 they are trying to evade those rules.
>
> Strangely, those messages are still getting tagged, mostly by razor and
> SURBL rules as they still have links to a website..
>
> The most recent example got hit by razor, a weak hit from bayes, and a
> lot of DNSBLs of the relay (tweaked SA 2.64):
>
> score=16.199, required 5,    BAYES_60 1.59, HTML_60_70 0.11,
> HTML_FONT_BIG 0.27,    HTML_MESSAGE 0.10,
> INFO_GREYLIST_NOTDELAYED -0.01,    MSGID_FROM_MTA_SHORT 1.00,
> PRIORITY_NO_NAME 1.21,    RAZOR2_CF_RANGE_51_100 0.20,
> RAZOR2_CHECK 1.05,    RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71,
> RCVD_IN_NJABL_PROXY 2.34,
> RCVD_IN_SORBS_HTTP 1.20,    RCVD_IN_SORBS_MISC 0.00, RCVD_IN_XBL 4.92
>
> So, while I've seen them, I have yet to get a FN on one.
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!