[SPAM] Certain spams not recognized by SP

Thomas Schürger <[email protected]> Fri, 12 Dec 2008 08:48:13 +0100

Newsgroups	gmane.mail.spam.spamprobe.general,gmane.spam.detected
Message-ID	<[email protected]>

Hi,

lately, I get a lot of HTML spams containing the subject "Delivery 
Status Notification (Failure)"
and the following body (with a lot of different target URLs for link and 
image):

---

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
</HEAD>
<BODY><a href="http://motivationsection.com/" target="_blank">
<img src="http://motivationsection.com/adv4.jpg" border=0 alt="Having 
trouble viewing this email?
Click here to view as a webpage."></a></BODY></HTML>

---

All of these spams have the same text in the "alt" attribute and so 
should be easily recognizable,
but with the standard scanning mechanism, this is not tokenized by 
SpamProbe. The headers of
these mails also look innocent. Therefore, SpamProbe treats these mails 
as hams.

Are there any ways of improving this with the standard scanning 
mechanism? I've seen that
using "-o graham" would improve recognizing these kinds of spams, 
because all HTML stuff is
tokenized, but I already have large databases with standard scanning and 
switching the mode
now wouldn't be the best, I guess.


Regards,
Thomas.


------------------------------------------------------------------------------
SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada.
The future of the web can't happen without you.  Join us at MIX09 to help
pave the way to the Next Web now. Learn more and register at
http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/