More mortgage spam. This one somehow evaded all the normal tests; I would propose the following modification to NORMAL_HTTP_TO_IP as a countermeasure:
uri NORMAL_HTTP_TO_IP /https?\:\/\/\d+\.\d+\.\d+\.\d+/is describe NORMAL_HTTP_TO_IP Uses a dotted-decimal IP address in URL This may slow down the test, but it will catch redirects such as the one below. -------- Original Message -------- From: - Sun May 26 09:00:33 2002 X-UIDL: 3ceb22ba0002a544 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: <[EMAIL PROTECTED]> Received: from imo-r01.mx.aol.com (imo-r01.mx.aol.com [152.163.225.97]) by raggy.doubledogmusic.com (8.11.6/8.11.0/Rbl-Orbs-Dul) with ESMTP id g4QFuCB08029 for <[EMAIL PROTECTED]>; Sun, 26 May 2002 08:56:13 -0700 Received: from [EMAIL PROTECTED] by imo-r01.mx.aol.com (mail_out_v32.5.) id g.1a.3f292aa (16225) for <[EMAIL PROTECTED]>; Sun, 26 May 2002 11:53:05 -0400 (EDT) Received: from netscape.net (mow-m20.webmail.aol.com [64.12.180.136]) by air-in02.mx.aol.com (v86.12) with ESMTP id MAILININ21-0526115304; Sun, 26 May 2002 11:53:04 -0400 Date: Sun, 26 May 2002 11:53:54 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Get the guaranteed lowest interest rate Message-ID: <[EMAIL PROTECTED]> X-Mailer: Atlas Mailer 2.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Spam-Status: No, hits=3.6 required=5.0 tests=NO_REAL_NAME,RAZOR_CHECK version=2.21 X-Spam-Level: *** Status: Certain chances only come around every few decades or so. This is one. Why you ask? Because home loan rates are headed up. Have you locked in the lowest rate, in almost thirty years, for your present home loan? Rates haven't been this low in a long time. They may well never be this low again. This is your chance to secure a better future. You could literally save enough money to buy that new car you've been wanting or to take that special vacation. Why wouldn't you jump at this chance? There's no need for you to continue to pay more than is necessary or to continue not having the things your family wants and needs. We're a nationwide mortgage lender. We're N0T a broker. And we can guarantee you the best rate and the best deal possible for you. But only if you take action today. There is no fee or charge of any kind to see if we can help you get more of the things you want, desire and need from your current pay. You can easily determine if we can help you in just a few short minutes. We only provide information in terms so simple that anyone can understand them. You won't need to be a lawyer to see the savings, this we promise. We offer both first and second home loans and we will be happy to show you why your current loan is the best for you. 0r why you should replace it. And once again, there's no risk for you. None at all. Take a couple of minutes and use the link below that works for you. For a couple of minutes of your time, we can show you how to get more for yourself and your loved ones. Don't lose this chance. Please take action now. Click_Here <http://n62.go2net.com/adclick?cid=180713&site=dp&cp=nbci&clickurl=http://61.129.81.99/paul/bren/mortg/> http://n62.go2net.com/adclick?cid=180713&site=dp&cp=nbci&clickurl=http://61.129.81.99/paul/bren/mortg/ Sincerely, James W. Minick MortBanc, Inc. __________________________________________________________________ Your favorite stores, helpful shopping tools and great gift ideas. Experience the convenience of buying online with Shop@Netscape! http://shopnow.netscape.com/ Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/ -- http://www.pricegrabber.com "We're smarter individually." -- Larry Niven _______________________________________________________________ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
