[Mimedefang] Considering an additional spam filter

[Michael Sims]

Quoting Kenneth Porter <shiva at sewingwitch.com>:

> > Yeah, I'm seeing this too.  I first noticed it when I saw the word
> > "Oprah" in  some HTML spam.  I knew that the mere presence of the word
> > "Oprah" should have  greatly increased the spam score, but this message
> > had scored very low.  When I  viewed the source I saw what you describe
> > with a letter or two interspersed  with invalid HTML tags.
> 
> What version of SA?

2.55...

> AFAIK this issue has been dealt with since 2.50, and 
> 2.55 was just released. Spam is a rapidly moving target, and you need to 
> upgrade SA frequently to keep up with the trends in spam obfuscation

I update SpamAssassin via the CPAN console as soon as a new version is 
released.  SpamAssassin is very good at catching this:

O<!-- blah -->pr<!-- blah -->ah

but not so good at this:

O<!9[d8Fi,ARFZSF[@F0,sz>p<!9[d8Fi,ARFZSF[@F0,sz>rah

The above is actually a sample from one of the messages in question.  The whole 
email is like that and it ends up scoring fairly low.  I've added a rawbody 
test for the above string which has helped...

I can send you the example message if you're curious...

___________________________________________
Michael Sims
Project Analyst - Information Technology
Crye-Leike Realtors
Office: (901)758-5648  Pager: (901)769-3722
___________________________________________