You could write yourself a rawbody rule to match on the string: td>NEVOB</td with a high score, and that will take care of this particular set (and seems to me, personally, to be at very low risk of FP- but then I'm American and have no idea what that word might mean in other languages), but you will have to write a new rule for the next mutation (this is the third or fourth variant I've seen already). and the next mutation. and the next......
Some BAYES training might help with detection, also, but even that won't necessarily push their score over the threshold, by itself. >>> "Dietmar Maurer" <[EMAIL PROTECTED]> 08/14/08 1:53 AM >>> Recently there are tons of simple mails like: ftp://pve.proxmox.com/tmp/sample-spam1.txt ftp://pve.proxmox.com/tmp/sample-spam2.txt Seems that they trigger some network tests, but many get through with low score. Does anybody know a way to block them effectively without using network tests? - Dietmar
