Arvid Ephraim Picciani wrote:
Heya,wondering if somone got a rule for those. For me it's too low volume to care. see attached mail.The sender isn't on any BL yet (might be in a few hours) , but the URL is already on uribl.com. SA doesn't detect the "obfuscation" unfortunatly. The bayes poison begins to be very common, so i wonder when SA will be able to differ between content and noise. the obfuscation of the drug name is quite funny so it might at least be usefull for some office-fun ;)
The following was posted on the SARE list. On Fri, 4 Jul 2008, at 15:55, Pete Fuggle wrote:
> body __OPEN_YOUR_BROWSER /\bOpen your browser\b/ > body __BI_CAPS_URL /http:\/\/.*\[[A-Z][A-Z]\]com/ > body __REPLACE_BI_CAPS /\bReplace \"[A-Z][A-Z]\" with \"\.\"/ > meta FASTBREAK_20080704 (__OPEN_YOUR_BROWSER && __BI_CAPS_URL && > __REPLACE_BI_CAPS) > score FASTBREAK_20080704 10.0
I guess the .* could be replaced by .{1,20}
