[Spambayes] Cute spam trick

Tim Peters tim.one at comcast.net
Sun Dec 15 21:11:01 EST 2002


I got a typical mortgage spam today, surprising because it scored 0.78, at
the high end of my personal-email Unsure range (which ends at 0.80).  There
were very few words in the clue listing; it got a score as high as it did
because of the subject line

    Low rates will not last forever.

some assorted spammish header clues, URL clues, and the single word
"month!".

Staring at the source revealed a cute trick I haven't seen before:

    ...
    Let the Len<!--yczvHV-->ders <br>
    Com<!--yczvHV-->pete for your Lo<!--yczvHV-->an!</font></b></div>
    ...

That is, the spammy words like Lenders and Compete and Loan! are broken up
by embedded HTML comments.  Our tokenizer does strip HTML comments, but
replaces each with a blank, so the spammy words remain broken up.

I'll fix that.  In the meantime, if anyone knows this spammer <wink>,
counsel them to break up the word "month!" too, as that was the
highest-spamprob token in the whole msg.




More information about the Spambayes mailing list