bayes-killing hidden text spam?
Mark Costlow <[email protected]> Tue, 23 Oct 2012 18:44:47 -0600
| Newsgroups | gmane.mail.spam.spamprobe.general |
|---|---|
| Message-ID | <[email protected]> |
We've been seeing a lot of a certain kind of spam lately. The body is HTML and it contains a ton of random text in an HTML comment, like so: <!-- > inducing towle# normally&ele vator&sup /interesse spanien A TTN/promote/240px/scared/Hughe s/durante/stance/Play/We/26cid /rgds/spok relatives?freedoms? ?envision?archives?dimens offe Thank-you, freitag Gioia Yalt ... taking;;freedoms;revelations;f ragrant;pourrons;abwechslung;c arcino jobid ntion;deployed; c tion/speed/touch/on/OK/little/ mass/things/morning/threat/mov ... n/indicated//10px/right/text/in/text/ul concours/i ntended/Help/De/ Weergave /again kidnappers/round/ mall/joeplemo selecciona overstepping 20Co lemm pu erto# fractionally >8859 >expedio voted.Lester.rob ber.New.El (Independence conflit ustomer/mitchell/ /natural/investors/habla/dust/links/Series/aptitud e/maturity/november/sou thisnode/frustrated/cualch ... --> That's followed by about 2kb of the actual spam message. The total message size is usally over 300kb. Generally these messages score low in spamprobe. They train fine, and do the right thing on resubmission, but the next one that comes through will have a different dictionary of garbage text, which again scores low. I've got some ideas for other attributes of these messages to try and block on, but thought I'd check with this list first just to see if anyone else has any good ideas. Are you all seeing these messages too? Thanks, Mark -- Mark Costlow | Southwest Cyberport | Fax: +1-505-232-7975 [email protected] | Web: www.swcp.com | Voice: +1-505-232-7992 Mail Minder - Intelligent Push Notifications for Email on the iPhone http://mailminderapp.com/download or in the App Store ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct