{Disarmed} How to deal with this carefully crafted HTML spam
Gao
gao at pztop.com
Mon Jun 13 16:08:11 UTC 2016
Hi all,
There is a type of spam with use carefully crafted HTML to form the
message body which always got low score. Is there a better way to filter
this out?
Here is the email looks like:
Here is the email source looks like:
Return-Path: <noreply at g-narration.com>
X-Original-To: mike at mydomain.com
Delivered-To: mike at mydomain.com
Received: by zeta.mydomain.com (Postfix, from userid 5001)
id 381A32003197E; Mon, 13 Jun 2016 02:41:57 -0700 (PDT)
Received-SPF: none (g-narration.com: No applicable sender policy available) receiver=zeta.mydomain.com; identity=mailfrom; envelope-from="noreply at g-narration.com"; helo=g-narration.com; client-ip=210.178.72.8
Received: from g-narration.com (unknown [210.178.72.8])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by zeta.mydomain.com (Postfix) with ESMTPS id D23582003197B;
Mon, 13 Jun 2016 02:41:48 -0700 (PDT)
Date: Mon, 13 Jun 2016 11:26:54 +0100
From: Canadian-Meds <noreply at g-narration.com>
X-Priority: 3
To: <mike at mydomain.com>, <careers at mydomain.com>, <info at mydomain.com>
Content-Type: multipart/alternative;
boundary="7Y696D91821252448Kr"
Message-ID: <4C1E46F4.1033858 at g-narration.com>
Subject: Throughout the long years of operation our company has become synonymous to quality!
MIME-Version: 1.0
X-mydomain-MailScanner-Information: Please contact the IT Administrator for more information
X-mydomain-MailScanner-ID: D23582003197B.A3D74
X-mydomain-MailScanner: Found to be clean
X-mydomain-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=1.969, required 3, BAYES_50 0.80, HTML_MESSAGE 0.00,
RCVD_IN_XBL 0.38, RDNS_NONE 0.79)
X-mydomain-MailScanner-SpamScore: 1
X-mydomain-MailScanner-From: noreply at g-narration.com
X-Spam-Status: No
--7Y696D91821252448Kr
Content-Type: text/plain; charset="windows-1251"; format=flowed; delsp=yes
Content-Transfer-Encoding: quoted-printable
=0A=0A=09=09League came up into a-power transmission oil missed, and=0Ai=
ncludingtheir views. Meats tableside in i-look sanjaya up that this=0Ajust =
didnt. =0A=0A=09=09Me=0A=09=09ds=0A=09=099f=0A=09=09or=0A=09=098M=0A=09=09e=
n=0A=0AVi=0ACi=0ACi=0ALe=0APr=0A ag=0Aal=0Aal=0Avi=0Aop=0A ra=0Ais=0Ais=0At=
r=0Aec=0A=0A S=0Aa =0Aia=0A=0Aof=0A=0At =0A=0ATa=0A=0Abs=0A=0A $0=0A$1=0A$2=
=0A$2=0A$0=0A .9=0A.6=0A.5=0A.5=0A.4=0A 9=0A5=0A0=0A0=0A5=0A=0A=09=09Me=0A=
=09=09ds=0A=09=098f=0A=09=09or=0A=09=092W=0A=09=09om=0A=09=09en=0A=0AAc=0AC=
l=0ADe=0AFe=0AFe=0A om=0Aom=0Afl=0Ama=0Ama=0A pl=0Aid=0Auc=0Ale=0Ale=0A ia=
=0A=0Aan=0A C=0A V=0A=0Aia=0Aia=0A=0Ali=0Agr=0A=0As =0Aa =0A=0A $1=0A$0=0A$=
1=0A$1=0A$0=0A .7=0A.4=0A.2=0A.1=0A.7=0A 5=0A5=0A5=0A1=0A2=0A=0A 24=0ANo=0A=
An=0ASp /7=0A p=0Aon=0Aec c=0Are=0Aym=0Aia us=0Asc=0Aou=0Al to=0Ari=0As =
=0Ain me=0Apt=0Ade=0Ate r =0Aio=0Ali=0Arn su=0An =0Ave=0Aet pp=0Are=0Ary=0A=
p or=0Aqu=0A=0Ari t =0Air=0A=0Ace =0Aed=0A=0As =0A=0A O=0A 1=0A V=0A =
F nl=0A00=0Ais=0Aas y =0A% =0Aa,=0At re=0AAu=0AMa=0Awo li=0Ath=0Ast=0Arl a=
b=0Aen=0Aer=0Adw le=0Ati=0Aca=0Aid s=0Ac =0Ard=0Ae up=0AMe=0A,E=0Ash pl=
=0Ads=0Ach=0Aip ie=0A=0Aec=0Api rs=0A=0Ak =0Ang =0A=0A=09=09>> Enter Here=
=20
--7Y696D91821252448Kr
Content-Type: text/html; charset="windows-1251"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.=
w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">=0A<html>=0A=0A<body leftmarg=
in=3D'0' marginwidth=3D'0' topmargin=3D'0' marginheight=3D'0' offset=3D'0' =
style=3D'-webkit-text-size-adjust:none !important;margin:0; padding:0;backg=
round-color:white;font-family:courier new;'>=0A<table border=3D'0' cellpadd=
ing=3D'0' cellspacing=3D'0' width=3D'100%' style=3D'-webkit-text-size-adjus=
t:none !important;margin:0; padding:0;background-color:white;font-family:co=
urier new;'>=0A<tr><td align=3D'center' >=0A<table border=3D'0' cellpadding=
=3D'0' cellspacing=3D'0' width=3D'552' align=3D'center' style=3D'-webkit-te=
xt-size-adjust:none !important;margin:0; padding:0;background-color:white;f=
ont-family:courier new;'>=0A<tbody>=0A<tr><td colspan=3D2 width=3D'550' sty=
le=3D'font-size:8pt;color:white;'>League came up into a-power transmission =
oil missed, and includingtheir views. Meats tableside in i-look sanjaya up =
that this just didnt. </td></tr>=0A=0A<tr><td>=0A<table style=3D'border-wid=
th:0; border-style:solid;' cellpadding=3D'0' cellspacing=3D'0' width=3D'270=
' bgcolor=3D'#e9f2db'>=0A<tbody>=0A<tr><td bgcolor=3D'#0000cd' height=3D24 =
style=3D'padding-left:10pt;'><table cellpadding=3D'0' cellspacing=3D'0' bor=
der=3D'0' height=3D'20' style=3D'font-size:13pt; font-weight:bold; color:wh=
ite'><tr><td>Me</td><td>ds</td><td><font color=3D'#0000cd'>9</font>f</td><t=
d>or</td><td><font color=3D'#0000cd'>8</font>M</td><td>en</td></tr></table>=
</td></tr>=0A<tr><td align=3D'center' style=3D'padding-top: 12pt;padding-le=
ft: 6pt; padding-bottom: 12pt;'>=0A<table cellpadding=3D'0' border=3D0 cell=
spacing=3D'0' width=3D'220'>=0A<tbody>=0A<tr><td style=3D'text-align:left;'=
>=0A<table border=3D'0' cellpadding=3D'0' cellspacing=3D'0' style=3D'font-s=
ize:12pt; line-height: 1.2; font-weight:bold;'>=0A<tbody>=0A<tr><td>Vi<br>C=
i<br>Ci<br>Le<br>Pr<br></td>
<td>ag<br>al<br>al<br>vi<br>op<br></td>
<td>ra<br>is<br>is<br>tr<br>ec<br></td>
<td> <br> <br> S<br>a <br>ia<br></td>
<td> <br> <br>of<br> <br> <br><=
/td>
<td> <br> <br>t <br> <br> =
<br></td>
<td> <br> <br>Ta<br> <br> <br><=
/td>
<td> <br> <br>bs<br> <br> <br><=
/td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td>$0<br>$1<br>$2<br>$2<br>$0<br></td>
<td>.9<br>.6<br>.5<br>.5<br>.4<br></td>
<td>9<br>5<br>0<br>0<br>5<br></td>
</tr></tbody></table>=0A</tbody>=0A</table>=0A=0A</td></tr>=0A</tbody>=0A</=
table>=0A</td><td>=0A<table style=3D'border-width:0; border-style:solid;' c=
ellpadding=3D'0' cellspacing=3D'0' width=3D'270' bgcolor=3D'#e9f2db'>=0A<tb=
ody>=0A<tr><td bgcolor=3D'#cc0064' height=3D24 style=3D'padding-left:10pt;'=
><table cellpadding=3D'0' cellspacing=3D'0' border=3D'0' height=3D'20' styl=
e=3D'font-size:13pt; font-weight:bold; color:white'><tr><td>Me</td><td>ds</=
td><td><font color=3D'#cc0064'>8</font>f</td><td>or</td><td><font color=3D'=
#cc0064'>2</font>W</td><td>om</td><td>en</td></tr></table></td></tr>=0A<tr>=
<td align=3D'center' style=3D'padding-top: 12pt;padding-left: 6pt; padding-=
bottom: 12pt;'>=0A<table cellpadding=3D'0' border=3D0 cellspacing=3D'0' wid=
th=3D'220'>=0A<tbody>=0A<tr><td style=3D'text-align:left;'>=0A<table border=
=3D'0' cellpadding=3D'0' cellspacing=3D'0' style=3D'font-size:12pt; line-he=
ight: 1.2; font-weight:bold;'>=0A<tbody>=0A<tr><td>Ac<br>Cl<br>De<br>Fe<br>=
Fe<br></td>
<td>om<br>om<br>fl<br>ma<br>ma<br></td>
<td>pl<br>id<br>uc<br>le<br>le<br></td>
<td>ia<br> <br>an<br> C<br> V<br></td>
<td> <br> <br> <br>ia<br>ia<br></td>
<td> <br> <br> <br>li<br>gr<br></td>
<td> <br> <br> <br>s <br>a <br><=
/td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td>$1<br>$0<br>$1<br>$1<br>$0<br></td>
<td>.7<br>.4<br>.2<br>.1<br>.7<br></td>
<td>5<br>5<br>5<br>1<br>2<br></td>
</tr></tbody></table>=0A</tbody>=0A</table>=0A=0A</td></tr>=0A</tbody>=0A</=
table>=0A</td></tr><tr><td height=3D7></td></tr><tr><td colspan=3D2 align=
=3Dcenter>=0A<table style=3D'border-width:0; border-style:solid;' bgcolor=
=3D'white' cellpadding=3D'0' cellspacing=3D'0' width=3D'546'>=0A<tr><td ali=
gn=3Dcenter>=0A<table cellpadding=3D'0' cellspacing=3D'0' width=3D'520' sty=
le=3D'padding-bottom:10pt;'>=0A<tbody>=0A<tr><td colspan=3D2 align=3Dcenter=
style=3D'padding-top:10pt; padding-bottom:10pt;'>=0A<table cellpadding=3D'=
0' cellspacing=3D'0' width=3D'506' style=3D'line-height: 1.5; font-size:11p=
t; font-weight:bolder;'>=0A<tr>=0A<td height=3D15 width=3D5>24<br>No<br>An<=
br>Sp</td>
<td height=3D15 width=3D5>/7<br> p<br>on<br>ec</td>
<td height=3D15 width=3D5> c<br>re<br>ym<br>ia</td>
<td height=3D15 width=3D5>us<br>sc<br>ou<br>l </td>
<td height=3D15 width=3D5>to<br>ri<br>s <br>in</td>
<td height=3D15 width=3D5>me<br>pt<br>de<br>te</td>
<td height=3D15 width=3D5>r <br>io<br>li<br>rn</td>
<td height=3D15 width=3D5>su<br>n <br>ve<br>et</td>
<td height=3D15 width=3D5>pp<br>re<br>ry<br> p</td>
<td height=3D15 width=3D5>or<br>qu<br> <br>ri</td>
<td height=3D15 width=3D5>t <br>ir<br> <br>ce</td>
<td height=3D15 width=3D5> <br>ed<br> <br>s </td=
>
<td height=3D15 width=3D5> <br> <br> <br>&=
nbsp; </td>
<td height=3D15 width=3D5> O<br> 1<br> V<br> F</td>
<td height=3D15 width=3D5>nl<br>00<br>is<br>as</td>
<td height=3D15 width=3D5>y <br>% <br>a,<br>t </td>
<td height=3D15 width=3D5>re<br>Au<br>Ma<br>wo</td>
<td height=3D15 width=3D5>li<br>th<br>st<br>rl</td>
<td height=3D15 width=3D5>ab<br>en<br>er<br>dw</td>
<td height=3D15 width=3D5>le<br>ti<br>ca<br>id</td>
<td height=3D15 width=3D5> s<br>c <br>rd<br>e </td>
<td height=3D15 width=3D5>up<br>Me<br>,E<br>sh</td>
<td height=3D15 width=3D5>pl<br>ds<br>ch<br>ip</td>
<td height=3D15 width=3D5>ie<br> <br>ec<br>pi</td>
<td height=3D15 width=3D5>rs<br> <br>k <br>ng</td>
<td height=3D15 width=3D5> <br> <br> <br> </td>
</tr>=0A</table>=0A</td></tr>=0A<tr><td colspan=3D2 align=3Dcenter><a href=
=3D'http://gots.ms/e8116' target=3D'_blank'><span style=3D'font-family:aria=
l;font-size:16pt;font-weight:bold;color:blue;text-decoration:underline;'>>>=
Enter Here <<</span></a></td></tr>=0A</tbody>=0A</table>=0A</td></tr>=0A</=
table>=0A</td></tr>=0A<tr><td height=3D7></td></tr>=0A<tr><td>=0A<table sty=
le=3D'border-width:0; border-style:solid;' cellpadding=3D'0' cellspacing=3D=
'0' width=3D'270' bgcolor=3D'#e9f2db'>=0A<tbody>=0A<tr><td bgcolor=3D'#ff99=
34' height=3D24 style=3D'padding-left:10pt;'><table cellpadding=3D'0' cells=
pacing=3D'0' border=3D'0' height=3D'20' style=3D'font-size:13pt; font-weigh=
t:bold; color:white'><tr><td>An</td><td>ti</td><td>bi</td><td>ot</td><td>ic=
</td><td>s</td></tr></table></td></tr>=0A<tr><td align=3D'center' style=3D'=
padding-top: 12pt;padding-left: 6pt; padding-bottom: 12pt;'>=0A<table cellp=
adding=3D'0' border=3D0 cellspacing=3D'0' width=3D'220'>=0A<tbody>=0A<tr><t=
d style=3D'text-align:left;'>=0A<table border=3D'0' cellpadding=3D'0' cells=
pacing=3D'0' style=3D'font-size:12pt; line-height: 1.2; font-weight:bold;'>=
=0A<tbody>=0A<tr><td>Am<br>Au<br>Ba<br>Ce<br>Ci<br></td>
<td>ox<br>gm<br>ct<br>ph<br>pr<br></td>
<td>ic<br>en<br>ri<br>al<br>o <br></td>
<td>il<br>ti<br>m <br>ex<br> <br></td>
<td>li<br>n <br> <br>in<br> <br></td>
<td>n <br> <br> <br> <br> =
<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td>$0<br>$1<br>$0<br>$0<br>$0<br></td>
<td>.5<br>.5<br>.3<br>.2<br>.3<br></td>
<td>2<br>9<br>5<br>4<br>0<br></td>
</tr></tbody></table>=0A</tbody>=0A</table>=0A=0A</td></tr>=0A</tbody>=0A</=
table>=0A</td><td>=0A<table style=3D'border-width:0; border-style:solid;' c=
ellpadding=3D'0' cellspacing=3D'0' width=3D'270' bgcolor=3D'#e9f2db'>=0A<tb=
ody>=0A<tr><td bgcolor=3D'#009967' height=3D24 style=3D'padding-left:10pt;'=
><table cellpadding=3D'0' cellspacing=3D'0' border=3D'0' height=3D'20' styl=
e=3D'font-size:13pt; font-weight:bold; color:white'><tr><td>Pa</td><td>in</=
td><td>ki</td><td>ll</td><td>er</td><td>s</td></tr></table></td></tr>=0A<tr=
><td align=3D'center' style=3D'padding-top: 12pt;padding-left: 6pt; padding=
-bottom: 12pt;'>=0A<table cellpadding=3D'0' border=3D0 cellspacing=3D'0' wi=
dth=3D'220'>=0A<tbody>=0A<tr><td style=3D'text-align:left;'>=0A<table borde=
r=3D'0' cellpadding=3D'0' cellspacing=3D'0' style=3D'font-size:12pt; line-h=
eight: 1.2; font-weight:bold;'>=0A<tbody>=0A<tr><td>Ar<br>Ce<br>Di<br>Fl<br=
>To<br></td>
<td>co<br>le<br>cl<br>ex<br>ra<br></td>
<td>xi<br>br<br>of<br>er<br>do<br></td>
<td>a <br>ex<br>en<br>il<br>l <br></td>
<td> <br> <br>ac<br> <br> <br><=
/td>
<td> <br> <br> G<br> <br> =
<br></td>
<td> <br> <br>el<br> <br> <br><=
/td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td>$0<br>$0<br>$9<br>$0<br>$0<br></td>
<td>.3<br>.5<br>.0<br>.8<br>.5<br></td>
<td>8<br>9<br>0<br>9<br>9<br></td>
</tr></tbody></table>=0A</tbody>=0A</table>=0A=0A</td></tr>=0A</tbody>=0A</=
table>=0A</td></tr><tr><td height=3D7></td></tr><tr><td>=0A<table style=3D'=
border-width:0; border-style:solid;' cellpadding=3D'0' cellspacing=3D'0' wi=
dth=3D'270' bgcolor=3D'#e9f2db'>=0A<tbody>=0A<tr><td bgcolor=3D'#990001' he=
ight=3D24 style=3D'padding-left:10pt;'><table cellpadding=3D'0' cellspacing=
=3D'0' border=3D'0' height=3D'20' style=3D'font-size:13pt; font-weight:bold=
; color:white'><tr><td>As</td><td>th</td><td>ma</td><td><font color=3D'#990=
001'>6</font>&</td><td><font color=3D'#990001'>1</font>A</td><td>ll</td=
><td>er</td><td>gy</td></tr></table></td></tr>=0A<tr><td align=3D'center' s=
tyle=3D'padding-top: 12pt;padding-left: 6pt; padding-bottom: 12pt;'>=0A<tab=
le cellpadding=3D'0' border=3D0 cellspacing=3D'0' width=3D'220'>=0A<tbody>=
=0A<tr><td style=3D'text-align:left;'>=0A<table border=3D'0' cellpadding=3D=
'0' cellspacing=3D'0' style=3D'font-size:12pt; line-height: 1.2; font-weigh=
t:bold;'>=0A<tbody>=0A<tr><td>Ad<br>Fl<br>Na<br>Se<br>Si<br></td>
<td>va<br>ov<br>so<br>re<br>ng<br></td>
<td>ir<br>en<br>ne<br>ve<br>ul<br></td>
<td> <br>t <br>x <br>nt<br>ai<br></td>
<td> <br> <br> <br> <br>r =
<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td>$2<br>$1<br>$1<br>$1<br>$0<br></td>
<td>4.<br>9.<br>7.<br>8.<br>.9<br></td>
<td>95<br>95<br>99<br>95<br>9<br></td>
</tr></tbody></table>=0A</tbody>=0A</table>=0A=0A</td></tr>=0A</tbody>=0A</=
table>=0A</td><td>=0A<table style=3D'border-width:0; border-style:solid;' c=
ellpadding=3D'0' cellspacing=3D'0' width=3D'270' bgcolor=3D'#e9f2db'>=0A<tb=
ody>=0A<tr><td bgcolor=3D'#663398' height=3D24 style=3D'padding-left:10pt;'=
><table cellpadding=3D'0' cellspacing=3D'0' border=3D'0' height=3D'20' styl=
e=3D'font-size:13pt; font-weight:bold; color:white'><tr><td>De</td><td>al</=
td><td>in</td><td>g<font color=3D'#663398'>9</font></td><td>wi</td><td>th</=
td><td><font color=3D'#663398'>0</font>D</td><td>ep</td><td>re</td><td>ss</=
td><td>io</td><td>n</td></tr></table></td></tr>=0A<tr><td align=3D'center' =
style=3D'padding-top: 12pt;padding-left: 6pt; padding-bottom: 12pt;'>=0A<ta=
ble cellpadding=3D'0' border=3D0 cellspacing=3D'0' width=3D'220'>=0A<tbody>=
=0A<tr><td style=3D'text-align:left;'>=0A<table border=3D'0' cellpadding=3D=
'0' cellspacing=3D'0' style=3D'font-size:12pt; line-height: 1.2; font-weigh=
t:bold;'>=0A<tbody>=0A<tr><td>Ce<br>Cy<br>Le<br>Pr<br>Pr<br></td>
<td>le<br>mb<br>xa<br>is<br>oz<br></td>
<td>xa<br>al<br>pr<br>ti<br>ac<br></td>
<td> <br>ta<br>o <br>q <br> <br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td> <br> <br> <br> <br> &=
nbsp;<br></td>
<td>$0<br>$1<br>$0<br>$1<br>$0<br></td>
<td>.5<br>.1<br>.6<br>.1<br>.3<br></td>
<td>0<br>3<br>3<br>1<br>5<br></td>
</tr></tbody></table>=0A</tbody>=0A</table>=0A=0A</td></tr>=0A</tbody>=0A</=
table>=0A</td></tr><tr><td height=3D7></td></tr>=0A=0A<tr><td colspan=3D2 w=
idth=3D'550' style=3D'font-size:8pt;color:white;'>Commute is tubes, where s=
he also. Economicforum study abroad and holidays according to office, the s=
ubject to point. Legend of saints and tough. Plans, designs, inventions or =
area buick. Develops a crowd, deeded rights of loved farida. Community i-fi=
gured the iep meeting agreed that. Column johnny said expected redundancy p=
ackages and discuss silent generally. Adventurous souls propoganda put off =
limits, workarounds will get rid of endure. </td></tr>=0A</tbody>=0A</table=
>=0A</td></tr>=0A</table>=0A=0A</body>=0A</html>=0A
--7Y696D91821252448Kr--
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20160613/68476738/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: spam.png
Type: image/png
Size: 34311 bytes
Desc: not available
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20160613/68476738/attachment.png>
More information about the MailScanner
mailing list