Something like this should work, although I am still learning so feel free to correct.
rawbody T_OBFU_EMPTY_TAGS /<(i|b|u)><\/\1>/i score T_OBFU_EMPTY_TAGS 0.1 The intended result would be any HTML <i>, <b> or <u> tag followed immediately by a closing tag, with no intervening characters. I did find a single test in 20_head_tests.cf called TO_ADDRESS_EQ_REAL that uses backreferences in this way, so I'm presuming it works. -- Scott -----Original Message----- From: Mark Ritchie [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 29, 2003 8:14 AM To: [EMAIL PROTECTED] Subject: [SAtalk] Exessive HTML Code I've added the popcorn, blackhair, and weeds rules a while back, but I've noticed that I'm still getting quite a few spams messages per day. It always seems to be the most offensive porn and such that makes it through. Here is an example of the source that get's through <HTML><html> <body bgcolor="#FFFFFF"> <p> NOT m<i></i>atu<b></b>re<i></i>, e<i></i>xpe<i></i>ri<i></i>enc<i></i>ed. NOT cheat<i></i>ing, on t<b></b>he s<i></i>i<i></i>de. <br> :: snip :: Now, as you can see the trick here to fool spamassassin is the <i> and <b> tags. Would it be possible to make a rule or adjust the rules so the <i></i> scores high? There is nothing inbetween and I'd have to say anyone sending messages like this is obviously a spammer. Mark ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
