[SURBL-Discuss] RE: Pesky Pron Spam

Chris Santerre csanterre at merchantsoverseas.com
Wed Aug 11 10:49:39 CEST 2004



>-----Original Message-----
>From: Rob McEwen [mailto:webmaster at powerviewsystems.com]
>Sent: Wednesday, August 11, 2004 9:02 AM
>To: 'SURBL Discussion list'
>Subject: [SURBL-Discuss] RE: Pesky Pron Spam
>Importance: High
>
>
>I keep getting this "pesky" pron spam which gets past my all 
>my filters (my
>regex-based linguestic filter, my spamhaus.org RBL filter, and my SURBL
>filter).
>
>I think that these are getting blocked the next day, but this 
>particular
>spammer is very aggressive and keeps sending new stuff so I 
>keep getting the
>new stuff before it gets a chance to get blocked.
>
>I have noticed some patterns in the e-mails. For example, they all have
>three images stacked vertically. Therefore, I think that I 
>should be able to
>catch these with the right formulation of rules within my 
>linguistic filter.
>
>You can find the raw contents of my most recent two of these 
>as follows:
>
>http://www.pvsys.com/pn01.txt
>
>http://www.pvsys.com/pn02.txt
>
>Does anyone have any suggestions? Note that I am not using 
>SpamAssassin. I
>am using another program. However, if SpamAssassin already 
>handles this,
>could someone point me to the rules that SpamAssassin uses so 
>that I can use
>these as a guide? Any other suggestions?
>
>Thanks!
>
>Rob McEwen
>
>

Look at these things they have in common. Need to look at rawbody code.

alt=3d
=2e(org|gif|htm) #split into 3
name=3dgenerator
==.HTM
bgColor=3d
face=3d
src=3d
border=3d
title=3d
face=3d
<STYLE></STYLE>

Needs to be one big meta rule 

HTH
--Chris


More information about the Discuss mailing list