[Spambayes] Table munging defeats SpamBayes

Mathew Hendry mdhpub at blueyonder.co.uk
Tue Dec 2 21:46:17 EST 2003


Here's a new one on me. I spotted just now when looking through my spam
corpus for "low scorers". The rendered version of the spam (In Outlook 2003
anyway) looks like this:

------------------------------begin
All Rx Products

Consultation at no cost
No embarassing M.D. visits
I want to know more <link>
------------------------------end

Most of that text is broken up into tiny pieces and inserted into tables,
followed by a huge <a> block filled mostly with randomized English text but
also, at the end, containing the web site href and "I want to know more".

SpamBayes gobbles up all the text inside the <a> but doesn't spot the
contents of the table because each apparent token is only 1-3 characters
long.

Fortunately the spammer scuppered s/h/itself a bit by including some spammy
text in the <a> block. That and my SpamAssassin/SpamCop mods pushed the
score up 50%, so it didn't escape entirely.

Return-Path: <nrlhayssam at ganesparanx.com>
Delivered-To: MUNGED
Received: (qmail 30533 invoked from network); 1 Dec 2003 19:56:10 -0000
Received: from unknown (HELO blade2.cesmail.net) (192.168.1.212)
  by blade4.cesmail.net with SMTP; 1 Dec 2003 19:56:10 -0000
Received: (qmail 27132 invoked from network); 1 Dec 2003 19:38:24 -0000
Received: from mailgate.cesmail.net (216.154.195.36)
  by blade2.cesmail.net with SMTP; 1 Dec 2003 19:38:22 -0000
Received: (qmail 12032 invoked from network); 1 Dec 2003 19:38:20 -0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
  by mailgate.cesmail.net with SMTP; 1 Dec 2003 19:38:20 -0000
X-Message-Info: +va6sINXO+/559KzjEJWSK7H4PWBM17OSlLJppzGa8s=
Received: from popgate.cesmail.net [192.168.1.201]
	by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)
	for MUNGED (single-drop); Mon, 01 Dec 2003 14:38:20 -0500 (EST)
Received: from mc3-f6.hotmail.com ([64.4.50.142]) by mc3-s4.hotmail.com with
Microsoft SMTPSVC(5.0.2195.6713);
	 Mon, 1 Dec 2003 10:09:31 -0800
Received: from mail.ganesparanx.com ([61.32.9.47]) by mc3-f6.hotmail.com
with Microsoft SMTPSVC(5.0.2195.6713);
	 Mon, 1 Dec 2003 10:09:14 -0800
Message-ID: <O4jLHS_7cM7vqsOU_ttbr at jDfh2UpBt_k2WDk>
Date: Mon, 01 Dec 2003 13:04:40 -0900 (EST)
From: "sharaf his new book I mostly specialize in creating a little magic in
the" <nrlhayssam at ganesparanx.com>
To: MUNGED
Subject: peqm Prescribed meds from hoomme  ddm
MIME-Version: 1.0
Content-Type: text/html
X-OriginalArrivalTime: 01 Dec 2003 18:09:15.0515 (UTC)
FILETIME=[3B0FECB0:01C3B836]
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on blade4
X-Spam-Level: ********
X-Spam-Status: hits=8.3 tests=FORGED_HOTMAIL_RCVD,HTML_90_100,HTML_MESSAGE,
	HTML_MIME_NO_HTML_TAG,LARGE_HEX,MIME_HTML_NO_CHARSET,MIME_HTML_ONLY,
	USERPASS version=2.60
X-SpamCop-Checked: 192.168.1.212 216.154.195.36 192.168.1.101 192.168.1.201
64.4.50.142 61.32.9.47 
X-SpamCop-Disposition: Blocked bl.spamcop.net

<table cellpadding=0 cellspacing=0 border=0><tr>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
Al<br>&nbsp;&nbsp;<br>Co<br>No<br></font></td></tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
l&nbsp;<br>&nbsp;&nbsp;<br>ns<br>&nbsp;e<br></font></td></tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
Rx&nbsp;<br>&nbsp;&nbsp;&nbsp;<br>ult<br>mba<br></font></td></tr></table></t
d>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
Pr<br>&nbsp;&nbsp;<br>at<br>ra<br></font></td></tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
odu<br>&nbsp;&nbsp;&nbsp;<br>ion<br>ssi<br></font></td></tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
ct<br>&nbsp;&nbsp;<br>&nbsp;a<br>ng<br></font></td></tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
s&nbsp;<br>&nbsp;&nbsp;<br>t&nbsp;<br>&nbsp;M<br></font></td></tr></table></
td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
&nbsp;<br>&nbsp;<br>n<br>&#46;<br></font></td></tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
&nbsp;&nbsp;<br>&nbsp;&nbsp;<br>o&nbsp;<br>D&#46;<br></font></td></tr></tabl
e></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
&nbsp;&nbsp;&nbsp;<br>&nbsp;&nbsp;&nbsp;<br>cos<br>&nbsp;vi<br></font></td><
/tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
&nbsp;<br>&nbsp;<br>t<br>s<br></font></td></tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
&nbsp;<br>&nbsp;<br>&nbsp;<br>i<br></font></td></tr></table></td>
<td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier
New, Courier, mono" size=2>
&nbsp;&nbsp;&nbsp;<br>&nbsp;&nbsp;&nbsp;<br>&nbsp;&nbsp;&nbsp;<br>ts&nbsp;<b
r></font></td></tr></table></td>
</tr></table>
<a Convention registration rates may be found in the chart below, in the
language and stimulates language growth. Through
"That's a good way to get lost, even for John Wayne. Is that what you were
trying to do"
: I am a high school student, who is doing a project on weighted grades, if
any of you guys could help me with this, I would sure appreciate it.
 , .       ,     ,              : ,  .  ,        .   ,              .   ,
,     ,            ,        (,              ),       ,        .         ,
,     ,     ,                                  
nbspnbsp"Why" asked Joel looking around. "And why here We've only been
walking for an hour."
onyi's death, had pencils, pens, papers, and other signs of habitation on
it. Wondering about this new development, Ford walked into Miller's office.
"Captain, who's been at ""Later," Miller said, pic
s novel a requirement for all students at this level. Almost all tenses are
covered past, present, future, and even some irregular verbs as well as
subjunctive. I also recommend this novel for student
e the road became a footpath. A quarter of a mile further on, at the eastern
limb of the bay, the path descended steeply, zigzagging across the cliff
face to a stretch of beach to the east of Holland 
PROBLEM, A CONFLICT WITH THE DOS VERSION OF THE SYTOS PLUS FILE BACKUP
2,150 items currently online, with photos,
16651672
Paperback,November1990OurPrice:19.95Barnes 18.95Holiday Delivery Schedule
dawn, Erystra saw Skurgiil in the pool at the far end of the valley. The
I like quite a few, and for different reasons. But if I had to choose
make. They have also, unfortunately, raised the inanity factor of
ood luck
Re: I NEED ALL THE HISTORY N DR SUESS SUCH AS HIS D.O.B AND HIS LIFE STORY
Ray Huskey 07:34:31 3022001
In telling the story of Milkman's quest to discover the hidden history of
the Deads, Morrison expertly weaves together elements of myth, magic, and
folklore. She grapples with fundamental issues of cl
space and quiet around here soon. But not soon enough for my liking.
L1Lucky Star8862299022288622990112,
talk about your dreams and aspirations. Tell me about where you want to
nbspnbspThen ended the Sixth Day.
 walked up and saw the markings and blood. Lorna gasped and immediately
reached her hand out to wipe the chalk away, but Ford stopped her."Don't
break it," he said. "Not yet. Wait until daylight.""Is 
WHAT TO DO IF YOU HAVE BEEN BILLED FOR AN ORDER
All about eubieee
Re: free shoolarship for industrial engeeniering  amir_darvish hoseini
15:14:19 6082002
Later, IBM improved the motherboard, so that it uses 64K chips instead of
16K chips. The 4
p70386r.exe 483171
His words sent a chill up my spine, but not the kind
operating system called 86DOS from Seattle Computer Products to offer
SG That everyone I
directions of my mother. It was neither good nor bad. He was not to blame,
but
the like. The unit is 'self recording.' You can even tell
Enter the calm and quiet of my journey into matters of Life, Light and
Transformation. Experience the serene and calming of Life
frozenly, her lips pursed in a tight circle about an inch across. "Did you
eat" Not eating is even worse than not listening. I muttered, "Can't go to
hell on an empty stomach..." "I didn't hear that. 
exclusion. The attempt to apprehend the universe as number is therefore the
LAN Server, NetWare 3.X, 4.X, UNIX, VINES,
"Shit Am I that predictable"
how to get schoolership Yosha Abdelsalam ElAmri 08:27:53 8222002
OT INCLUDED.
and neck just appeared to fit right, to be proportional for his size, his
body.
extraneous opinions, but also all beliefs about the external existence of
the
 and more about being pursued. Wist found herself urging her horse to
greater and greater speeds even in the wilder and more treacherous parts of
the road. Still she could not shake the feeling that t
ii. Essential Being:.
ee the truth behind Pol Pot. "You've seen us from Angola," Quentin said, the
camera swinging back to face him. "From Nicaragua, from Cambodia and the
Philippines, from Iraq and Afghanistan. But you've
Palm Reader (.pdb)
by Pat from Alexandria, VA on 07162003 18:32:54
Then it dawned on Jack. Did you say Metafire Two is reporting
"What""At the church. You said you knew who would know where to find
Nale.""Nale" Ford asked. "Jake, have you been drinking""Chris," Jake yelled.
"Quit fucking around. Did you find Lorna""No," Ford s
r Fate"Principles That Can Change Your DestinyChapter II.Desire: The
Starting Point of All Achievement15The Man Who Burned BridgesThe Spur That
Drives to RichesSix Ways to Turn Desire Into GoldCan You
President quickly scanned the letter and took a moment to gaze at the
dormant
latitudes.
Danny Elfman
tchildren were so excited that for a while they almost forgot about eating.
There were toys the like of which they had never seen before, all beautiful
and some obviously magical. Many of them had ind
Q) 4.5 What is QIC80, QIC40
by Connie Korda illustrated by Middy Thomas
Incredible
to little Tony from upstairs and Xray Jr. We were going to go next door, but
He was not ready to die from his first heart attack and it served a useful
digitaltrip wrote: Here are several questions:
10 issues12 months
anymore. So, he didnt. But
Chaldeans did attribute divinity to celestial objects.
for incest in the home, and thats why females are removed
As soon as she judged it seemly, she went to himbut here he was, coming to
her.
Windows 95 Upgrade Path
Raam sat down in his seat.
All Products
housands of people from every disease you can imagine. He discovered our
health is not founded on what we think it is.
Daily online Egroup spiritual newsletter.
Maggie, my only companion, as I said earlier had long since left for
Hollywood and never wrote much. My only means of friendship with anyone was
through my Amateur Radio hobby, but I rarely got on the
 men were plowing the sparse fields and threshing corn. The women sat in
front of the tentlike huts knitting and playing with the children. Abdul
introduced John to his mother and father. John and Abd
DRAM Dynamic Random Access Memory
uiet contemplation with his family. No doubt he'll need it after the
predicted storms at next week's Labour Party Conference, which will be held
at the Millennium Dome's new Conference Centre.
Beth Ramshaw
The phrase that you dragged across turns black. Turning the phrase black is
called selecting the
which affect human affairs and destinies. Astrologers and
for our mistakes. I ate there two or three times a week, and Katie and I
spent a lot of time together on the weekends. She was a wonderful child,
Leslie, sweet and loving and patient and smart. I love
Re: I need a schoolarship  adebayo ogunjobi 22:04:43 9272002
( Excellent Chris. Excellent... for a piece of Wetware. ) Leta teased.
do Second Deal, Pseudo Bottom Deal, or Pseudo Middle Deal The Secret
Reverse; The Braue Reverse (Fred Braue) (several variations); Double Lift
Reverse I; Double Lift Reverse II; Double Lift Reverse II
"Oh, right." Astor decided not to get involved in trying to find out why his
father would need the services of a private detective.
 last year and another quick jump with another woman two years ago"
over a wealth of entertaining, unexpected information. Wands and wizards,
boggarts and broomsticks, hippogriffs and herbology, all have astonishing
histories rooted in legend, literature, or reallife 
Includes a Sampler of Sites
beautifully done film but ended with a ridiculous twist. there is also a
very strong homosexual complex portrayed so subtlely in this movie just like
the novel that george eliot wrote. i do consider g
For if one refuses, he will suffer anyway and get no credit
cost even less; in 1993, IBM began selling Ambra computers, which cost even
less.
theres a problem.
handful of the rough cotton jacket and
fear he instilled, only he could. Although she shuddered to believe it, her
Re: Dr. Suess janice lewis 16:35:11 3012000
hadnt been graded in years.
>From honeymoons to invitations to wedding gifts, couples and
 "GrantStation's affordable, singlesource
David Wighton
a good distance as thou wouldst do poison, and always cultivate carefully
the
target=^_self^href="http://geocities.com.jlhnkm@geocities.com.mzsovzfz@geoci
ties.com/mn?geocities.com/bvjrxauybd/xc at geocities.com/ywrt/?3278563856358139
0355438966482209128135126346306946246381543316053114711844047578530759428158
9030"href=`http://geocities.com.gbjzjvb@geocities.com.wmy@geocities.com/rhzz
?geocities.com/ukbsicm/ub at geocities.com/qwcfkfate/?1258361836156119753523694
62802818461158443261049260443613413887711865190247655583379392261387010`href
='http://geocities.com.ebjzegcs@geocities.com.en@geocities.com/xgbshq?geocit
ies.com/thryf/tdqsobxb at geocities.com/uqjcm/?12583618361561197535236946280281
8461158443261049260443613413887711865190247655583379392261387010'  
target='_self'href="http://geocities.com.gufma@geocities.com.nwgbd@geocities
.com/ssndo9k21?geocities.com/cchualivtt/jxkzulmtmq at geocities.com/kqfs/?01331
5894946914433221125087540280349242779017449317602548644672069052877300780674
2001446287481210377373479322110911387270271523409664722047047314526017528460
6388819642149722974513219864458907226336547298178317665544357178465481836015
2707387684325708848803861146391227124017461368608402268"href="http://geociti
es.com.tdfwfn at geocities.com.qavbabjom@geocities.com/wb?geocities.com/pjdn/se
@geocities.com/fzts/?8438169016874191551503492608746164418764230682290676234
11485685783663170045635381359190241185082"target=`_self` 
href="http://geocities.com.zvgj@geocities.com.tnxx@geocities.com/tb?geocitie
s.com/vz/vawftaqqp at geocities.com/ekhu/?5206765876550959237563178668422932095
53283665089664483097453362551349138642403067327796209781850">
I want to know more
</a>




More information about the Spambayes mailing list