> -----Original Message----- > From: Bill Anderson > Sent: Tuesday, October 14, 2003 12:03 PM > To: Spamassassin > Subject: [SAtalk] New rule for disguised html? > > > I am no rule coder, so I was wondering if anyone has a rule to catch > spammers that hide their url in their email. Here is an > example of what it > getting through my spam filters: > > href="http://wewillneed.c > ;om/c/iron.html?farrow=elrlnm" > > It looks to me that a rule that find's http://, &, and > numbers in between " ". would be a good candidate. I can see it, but > I can't code it. Thanks.
Jennifer Wheeler has some rules (http://spamhammers.nxtek.net/). I also have one: rawbody MY_RBDY_OBFU_ISOD /&\#(6[5-9]|[7-9][0-9]|1[0-1][0-9]|12[0-6])\D/ describe MY_RBDY_OBFU_ISOD MY: OBFU text with ISO DEC set score MY_RBDY_OBFU_ISOD 4.0 --Larry ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
