It's in Spam, but is it in regular email?

At this point nearly everyone has gotten a piece of spam with the subject of something like, "Phramacie News" pitching various drugs. The spam subject line employs various aggressive misspelling techniques to confound spam blocker applications.

The real frustration for those looking to combat spam appears in the message body. To the casual viewer, all looks normal. Various drug names are mentioned with correct spellings and prices. This should be an easy catch with a few basic rules.

Unfortunately, the author appears to be using some tricky software to scramble the message. Large amounts of HTML formatting is used to obfuscate the content, while having it render as intended for viewers.

Specifically, a "span" tag is used to cause the message to display in a non-intuitive way. In a relatively short message, up to 50 span tags may be used. Span tags are normally used to define an area of special formatting. A logical leap might be to filter (junk) mail messages which have span tags comprising more than a certain percentage of their body.

The initial research indicated this tactic might be a good one. It would certainly be capable of identifying nearly all offending messages in the campaign. However, some further evaluation showed this rule wouldn't be a good idea to implement. It turns out that some email clients produce heavily formatted HTML code, using a dedicated "span" tag for each line.

If the rule had been implemented in the anti spam email filter as is, it would have certainly blocked some wanted email messages. Any time a non-obvious rule is added to a filter, further investigation must be done to make sure it doesn't result in excessive false-positives.

Back