From csanterre@merchantsoverseas.com Wed Aug 11 15:48:38 2004
From: Chris Santerre <csanterre@merchantsoverseas.com>
To: discuss@lists.surbl.org
Subject: RE: [SURBL-Discuss] RE: Pesky Pron Spam
Date: Wed, 11 Aug 2004 09:49:39 -0400
Message-ID:
 <620A4FF9B83DD511B69900062939D037ABFF3A@internal.merchantsoverseas.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0341764404866459626=="

--===============0341764404866459626==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit



>-----Original Message-----
>From: Rob McEwen [mailto:webmaster(a)powerviewsystems.com]
>Sent: Wednesday, August 11, 2004 9:02 AM
>To: 'SURBL Discussion list'
>Subject: [SURBL-Discuss] RE: Pesky Pron Spam
>Importance: High
>
>
>I keep getting this "pesky" pron spam which gets past my all 
>my filters (my
>regex-based linguestic filter, my spamhaus.org RBL filter, and my SURBL
>filter).
>
>I think that these are getting blocked the next day, but this 
>particular
>spammer is very aggressive and keeps sending new stuff so I 
>keep getting the
>new stuff before it gets a chance to get blocked.
>
>I have noticed some patterns in the e-mails. For example, they all have
>three images stacked vertically. Therefore, I think that I 
>should be able to
>catch these with the right formulation of rules within my 
>linguistic filter.
>
>You can find the raw contents of my most recent two of these 
>as follows:
>
>http://www.pvsys.com/pn01.txt
>
>http://www.pvsys.com/pn02.txt
>
>Does anyone have any suggestions? Note that I am not using 
>SpamAssassin. I
>am using another program. However, if SpamAssassin already 
>handles this,
>could someone point me to the rules that SpamAssassin uses so 
>that I can use
>these as a guide? Any other suggestions?
>
>Thanks!
>
>Rob McEwen
>
>

Look at these things they have in common. Need to look at rawbody code.

alt=3d
=2e(org|gif|htm) #split into 3
name=3dgenerator
==.HTM
bgColor=3d
face=3d
src=3d
border=3d
title=3d
face=3d
<STYLE></STYLE>

Needs to be one big meta rule 

HTH
--Chris

--===============0341764404866459626==--