Spam Filter ISP Support - Block pictures and HTML formats

Print Page | Close Window

Block pictures and HTML formats

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5335
Printed Date: 22 January 2025 at 8:00am

Topic: Block pictures and HTML formats

Posted By: JohnDpatriot
Subject: Block pictures and HTML formats
Date Posted: 19 September 2005 at 11:32am

Lately I have been receiving a lot of spam formated as below.

M
C
U
L
P
C
V
A
V
X

e
I
l
e
r
e
A
m
I
a

r
A
t
v
o
l
L
b
A
n

i
L
r
i
p
e
I
i
G
a

d
I
a
t
e
b
U
e
R
x

ia
S
m
ra
cia
rex
M
n
A

$1

$3

$3

.21

.75

.33

http://www.perapestim.com - http://www.perapestim.com

How do I block these????

John,

In Plain text looks like.

xia

cia

rex

.21

.75

.33

http://www.perapestim.com/ - http://www.perapestim.com

Replies:

Posted By: Guests
Date Posted: 19 September 2005 at 1:13pm

Try putting perapestim.com in your keywords filter.

perapestim::Honeypot

Posted By: Alan
Date Posted: 19 September 2005 at 1:26pm

You can try adding

<div>

to your keyword blacklist.
It appears that is what the spammer is using.

Posted By: Guests
Date Posted: 21 September 2005 at 9:08am

the <div> idea is good expect that alot of email we receive is in HTML format nowadays so this will cause issues.

I was hoping we could find away of getting spam filter to read the file as it would appear to the end user. then scan for keywords. Here is th HTML for the email if that helps.

John,

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2180" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff><B>From:</B> Olivia Semien
[semv@res-radio.net]<BR><B>Sent:</B> Tuesday September 20, 2005 6:02
PM<BR><B>To:</B> John deBlieck<BR><B>Subject:</B> Re: Phadrmaceutical V ery
Useful<BR>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Courier>
<DIV style="FLOAT: left">X<BR>C<BR>M<BR>A<BR>L<BR >U<BR>P<BR>V<BR>C<BR>V</DIV> ;
<DIV style="FLOAT: left">a<BR>e<BR>e<BR>m<BR>e<BR >l<BR>r<BR>I<BR>I<BR>A</DIV> ;
<DIV style="FLOAT: left">n<BR>l<BR>r<BR>b<BR>v<BR >t<BR>o<BR>A<BR>A<BR>L</DIV> ;
<DIV style="FLOAT: left">a<BR>e<BR>i<BR>i<BR>i<BR >r<BR>p<BR>G<BR>L<BR>I</DIV> ;
<DIV style="FLOAT: left">x<BR>b<BR>d<BR>e<BR>t<BR >a<BR>e<BR>R<BR>I<BR>U</DIV> ;
<DIV
style="FLOAT: left"><BR>rex<BR>ia<BR>n<BR>ra< ;BR>m<BR>cia<BR>A<BR>S<BR>M</D IV>
<DIV style="FLOAT: left"><BR><BR><BR><BR><BR>& lt;BR><BR>$3<BR>$1<BR>$3</DIV>
<DIV style="FLOAT: left"><BR><BR><BR><BR><BR>& lt;BR><BR>.33<BR>.21<BR>.75</DIV>
<DIV style="CLEAR: both"> </DIV>
<DIV><A
href="http://www.someseoul.com">http://www.someseoul.com http://www.someseoul.com">http://www.someseoul.com</A& gt;</DIV></FONT></DIV></BODY></HT ML>

Posted By: Marcus
Date Posted: 21 September 2005 at 10:55am

I generally target these by keywording the site referenced, this way I block recurrances of this message and anything else referencing this site. In this case:

(\bsomeseoul\.com\b)

would block any references to this site in future emails. Works good for me.

Hint - try and target stuff in the HTML - cuts down on the false-positives.

Marcus

Print Page | Close Window