Skip to content

Archives

Annoying Non-spam Tricks, pt. XVIII

Published January 13, 2004

Spam: OK, I just noticed that I have a few hits for the SpamAssassin rule HTTP_ENTITIES_HOST in my corpus. This searches for obfuscated hostnames in the URL links in mail messages, and is generally a very reliable sign of spam — because who would want to hide a hostname apart from spammers?

Well, Buy4Now.IE, for one, it seems. WTF? I have a mail here that uses this markup: 

  <a href="''http://www&#46;buy4now&#46;ie/fbd''>





Totally and utterly nuts.  If they really wanted a way to tickle
malware detectors, mail filters, and anti-spam measures, they
could hardly pick a better one.   I have no idea why they did this.




grr....


				
	
	Comments closed