multipart spam

[Boris 'pi' Piwinger]

"Chris Fortune" <cfortune at telus.net> wrote:

>Somebody has probably mentioned this already, but there seems to be a growing trend in "hard to classify" spam lately: MIME emails
>with two multipart sections: text and html.  

We had this discussion already many times. Does not seem to
be true.

>The payload of the mail is in the HTML section (consisting of images and urls), but the
>text section is filled with either conversational text taken from books, etc, or -even worse- authentic "ham" e-mails, 

What is that? The spammer cannot know what ham means for me.

>obviously sampled from somebody's sent folder.  

So this is not known to my filter.

>The result is a very low bogosity score.  

Actually, I never see those problems. It might be that your
training was somehow insufficient.

>Other than registering each and every one of these
>mails, then retraining the wordlist, any suggestions?

Training to exhaustion:-))

>I guess this could also be the beginning of a thread about de-obsfucation.  

What should that do?

pi