HTML Table SPAM?
devonharding at gmail.com
Tue Mar 29 00:24:24 IST 2005
[ The following text is in the "ISO-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]
Here is my RBL's and they still seem to get through. What can I do to stop em'?
Spam List = dslb.org ORDB-RBL SBL+XBL spamhaus.org spamhaus-XBL
spamcop.net NJABL CBL RSL DSBL SORBS-SPAM SURBL
On Mon, 28 Mar 2005 13:55:49 -0500, Matt Kettler <mkettler at evi-inc.com> wrote:
> Devon Harding wrote:
> >Has any seen these kind of SPAM passing through? Where the SPAMMER
> >would use HTML tables to separate the offensive content? The words
> >looks clear when received, but every two letters are separated by a
> I've seen several of these, mostly in drug spams. Apparently now that
> antidrug is in SA 3.0 they are trying to evade those rules.
> Strangely, those messages are still getting tagged, mostly by razor and
> SURBL rules as they still have links to a website..
> The most recent example got hit by razor, a weak hit from bayes, and a
> lot of DNSBLs of the relay (tweaked SA 2.64):
> score=16.199, required 5, BAYES_60 1.59, HTML_60_70 0.11,
> HTML_FONT_BIG 0.27, HTML_MESSAGE 0.10,
> INFO_GREYLIST_NOTDELAYED -0.01, MSGID_FROM_MTA_SHORT 1.00,
> PRIORITY_NO_NAME 1.21, RAZOR2_CF_RANGE_51_100 0.20,
> RAZOR2_CHECK 1.05, RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71,
> RCVD_IN_NJABL_PROXY 2.34,
> RCVD_IN_SORBS_HTTP 1.20, RCVD_IN_SORBS_MISC 0.00, RCVD_IN_XBL 4.92
> So, while I've seen them, I have yet to get a FN on one.
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner