> -----Original Message----- > From: Howard Brazee [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 30, 2003 8:55 AM > To: Spamassassin-Talk (E-mail) > Subject: [SAtalk] What's the best way to filter the following?: > > > What's the best way to filter the following?: > > <html><body>hi, howard.brazee > <p><a href="http://www.xzxdd.com/mi/";><img > border="0" src="http://www.erfdewwq.com/h.jpg";></a></p> > <a href="http://www.xzxdd.com/h.html";>aoveiyr</a> > </body></html> >
1)Write a rule to catch the 2 domains. They won't change those often. 2)I have a rule on my site, last update, that looks for 1 character named scripts. I think it would be perfect to also look for single character images and html pages like you have here. I will put those in my next update, which should be Monday or Tuesday. 3) I'm not sure if Fred's OBFU rules would catch the "aoveiyr", I'll have to double check. Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
![http://www.erfdewwq.com/h.jpg"](http://www.erfdewwq.com/h.jpg"){kind=link}