Text shows something different than what is there.

[Steve Campbell]

Scott Silva wrote:
> on 11/28/2007 10:23 AM Steve Campbell spake the following:
>>
>>
>> Scott Silva wrote:
>>> on 11/28/2007 6:02 AM Steve Campbell spake the following:
>>>>
>>>>
>>>> Scott Silva wrote:
>>>>> on 11/27/2007 2:11 PM Steve Campbell spake the following:
>>>>>> Sorry if this has been discussed before. I may have not realized 
>>>>>> what was being discussed until I saw it in front of me.
>>>>>>
>>>>>> We are getting tons of email with different sexual content. When 
>>>>>> viewing the source of the email through Thunderbird, a few of the 
>>>>>> lines show up like the following:
>>>>>>
>>>>>> IF YOU WANT TO F wol UC sty K SOMEBODY,
>>>>>> F oy U zb CK YOURSELF & SAVE YOUR MONEY!
>>>>>>
>>>>>> The email when viewed normally through Thunderbird (and probably 
>>>>>> most other clients) is different. If you remove all of the lower 
>>>>>> case letters and the spaces around them, you'll see what the 
>>>>>> viewed text is displaying.
>>>>>>
>>>>>> Can anyone explain what is going on there and a pretty good way 
>>>>>> to block this. The F-word is pretty blatant in these.
>>>>>>
>>>>>> Thanks,
>>>>>>
>>>>>> Steve Campbell
>>>>>>
>>>>>>
>>>>> If you can post a raw sample somewhere, we could try it and see 
>>>>> what existing stuff might hit it.
>>>>>
>>>> Scott,
>>>>
>>>> Thanks for the reply.
>>>>
>>>> Upon further review of the messages on other machines using other 
>>>> browsers, I find some HTML or something using bracketed "span" tags 
>>>> in between the letters.
>>>>
>>>> I'm not sure the best way to stop it for now, but at least I have a 
>>>> clue as to what's going on.
>>>>
>>>> Steve
>>>>
>>> Are you running any of the sare rules? Especially the obfu and 
>>> chickenpox ones?
>>
>> I run just a very few, but I will look into the ones you mentioned.
>>
>> Thanks, Scott
>>
>> Steve
>>>
>>>
>>
> That is why I suggested putting up a raw copy to test. You could get 
> some ideas on what works.
> I actually get a lot of hits with sare_obfu and chickenpox. YMMV
>
I put the obfu0 and chickenpox sets on and the scores shot through the 
roof. Looks like these will fit the bill for a while. Thanks for the 
pointers to these sets.

I should probably browse the SARE sets once in a while, since the adult 
and stock sets I run do quite a good job.

Steve