[Mimedefang] Tiny Text

Jonathan Maliepaard jon at enetworks.co.za
Tue May 10 09:32:21 EDT 2005


Hi

I received  an email containing 1pt text (all very clever) and it came
right through our Can-It scanner. The random letters spelled out various
drugnames.

Is it safe enough to create a rule that looks at a raw body and scores
mail containing say fonts between 1 and 3 pixels? 

Maybe something like?

describe TINY_TEXT_1               Body includes very small html text
rawbody TINY_TEXT_1                /FONT-SIZE: (?:1|1.5|2|2.5|3)px/i
score TINY_TEXT_1                  3.0
#
describe TINY_TEXT_2               Body includes very small html text
rawbody TINY_TEXT_2                /FONT-SIZE: (?:1|1.5|2|2.5|3)\;/i
score TINY_TEXT_2                  3.0
 
<challenge> Can someone do this more eloquently? </challenge> 

Thanks

Jon.




More information about the MIMEDefang mailing list