bayes-killing hidden text spam?

Mark Costlow <[email protected]> Tue, 23 Oct 2012 18:44:47 -0600
Newsgroups gmane.mail.spam.spamprobe.general
Message-ID <[email protected]>
We've been seeing a lot of a certain kind of spam lately.  The body is
HTML and it contains a ton of random text in an HTML comment, like so:

<!--
> inducing towle# normally&ele
vator&sup /interesse spanien A
TTN/promote/240px/scared/Hughe
s/durante/stance/Play/We/26cid
/rgds/spok relatives?freedoms?
?envision?archives?dimens offe
 Thank-you, freitag Gioia Yalt
... 
taking;;freedoms;revelations;f
ragrant;pourrons;abwechslung;c
arcino jobid ntion;deployed; c
tion/speed/touch/on/OK/little/
mass/things/morning/threat/mov
...
n/indicated//10px/right/text/in/text/ul concours/i
ntended/Help/De/ Weergave /again kidnappers/round/
mall/joeplemo selecciona overstepping 20Co lemm pu
erto# fractionally >8859 >expedio voted.Lester.rob
ber.New.El (Independence conflit ustomer/mitchell/
/natural/investors/habla/dust/links/Series/aptitud
e/maturity/november/sou thisnode/frustrated/cualch
...
-->

That's followed by about 2kb of the actual spam message.  The total message
size is usally over 300kb.

Generally these messages score low in spamprobe.  They train fine, and
do the right thing on resubmission, but the next one that comes through
will have a different dictionary of garbage text, which again scores low.

I've got some ideas for other attributes of these messages to try and
block on, but thought I'd check with this list first just to see if
anyone else has any good ideas.  Are you all seeing these messages too?

Thanks,

Mark
-- 
Mark Costlow    | Southwest Cyberport | Fax:   +1-505-232-7975
[email protected] | Web:   www.swcp.com | Voice: +1-505-232-7992

Mail Minder - Intelligent Push Notifications for Email on the iPhone
http://mailminderapp.com/download  or in the App Store


------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct