Looks like we'll need to modify the HTTP_ESCAPED_HOST rule for this type of thing... Or maybe another rule to catch these obfuscations? Something like:
uri OBFUSCATED_URI /^(\w+:(?:\/\/)?)\1/ Or to modify the current rule: uri HTTP_ESCAPED_HOST /^(https?:(?:\/\/)?)\1?[^\/]*%/ These both catch the URLs as listed in the message below. ----- Forwarded message from [EMAIL PROTECTED] ----- To: <[EMAIL PROTECTED]> From: [EMAIL PROTECTED] Subject: Details LQYLWT Date: Tue, 23 Apr 2002 19:43:07 -2000 SPAM: -------------------- Start SpamAssassin results ---------------------- SPAM: This mail is probably spam. The original message has been altered SPAM: so you can recognise or block similar unwanted mail in future. SPAM: See http://spamassassin.org/tag/ for more details. SPAM: SPAM: Content analysis details: (13.7 hits, 5 required) SPAM: Hit! (2.7 points) Subject contains lots of white space SPAM: Hit! (2.1 points) Invalid Date: header (timezone does not exist) SPAM: Hit! (2.0 points) From: contains numbers mixed in with letters SPAM: Hit! (1.3 points) Received via SMTPD32 server (SMTPD32-n.n) SPAM: Hit! (1.0 point) From: ends in numbers SPAM: Hit! (0.6 points) From: does not include a real name SPAM: Hit! (2.0 points) Received via a relay in bl.spamcop.net SPAM: [RBL check: found 3.156.153.212.bl.spamcop.net.] SPAM: Hit! (2.0 points) Subject contains a unique ID number SPAM: SPAM: -------------------- End of SpamAssassin results --------------------- FREE Professional Help and Relief From Too Many Bills. Find out Why Our Finance- Management Program is the # 1 Way For Dealing With your finances. We provide FREE Professional Help To Instantly Reduce Your Interest Rates and Minimum Payments. "We Get Your Creditors Off Your Back!" With One Phone Call, We Can Get Your Creditors To Do the Following: * Lower your monthly payments by 40-60%. * Save thousands of dollars in interest and late charges. * End Creditor Harassment! * Start improving your credit rating. * Cut your bills in half. * Consolidate your bills into One Low monthly payment. * Eliminate interest and late fee charges. >From credit counseling to bill consolidation we have the FREE information and resources to provide you with fast relief from credit card and other bills. Let us put Our Expertise to Work for You Now! http://http://%361.%31%32%39.81.%35%38/a%6C/d%65b%74%2F Get out of debt Easily Unlist http://http://61.1%329.%38%31.5%38%2Fal%2F%75n%73%2F ----- End forwarded message ----- -- Randomly Generated Tagline: "How to knock yourself out: Take a large herring, make contact with back of head. Repeat if necessary." - Theo _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
