[Mimedefang] Interesting way to send spam

[David F. Skoll]

On Thu, 24 Feb 2005, Marcelo Souza wrote:

>         This one came to me this week and I it's different from any of
> that list on jsc.org:

Interestingly, our spam software caught this!  Analysis below.  The
SURBL and Bayes techniques are quite powerful.  Because the MIMEDefang list
gets hardly any HTML traffic, things like "href" and "ffffff" are very strong
indicators of spam in its Bayes DB.

Regards,

David.

Spam Analysis Report (Score = 14.8):

 0.6 J_CHICKENPOX_21        BODY: {2}Letter - punctuation - {1}Letter
 0.6 J_CHICKENPOX_13        BODY: {1}Letter - punctuation - {3}Letter
 0.6 J_CHICKENPOX_31        BODY: {3}Letter - punctuation - {1}Letter
 3.0 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL blocklist
                            [URIs: apostrophegood.com]

Statistical Analysis:
Word: href (0.990)
Word: meds (0.990)
Word: ffffff (0.990)
Word: font-size (0.990)
Word: 100 (0.713)
Word: more (0.618)
Word: came (0.611)
Word: week (0.601)
Word: less (0.596)
Word: get (0.384)
Word: too (0.298)
Word: different (0.283)
Word: list (0.101)
Word: s*spam (0.019)
Word: s*Mimedefang (0.010)
Combined probability = 0.9997
Score of 10 points due to statistical analysis