Yes , I'm understanding what you saying and also understand the
implications of FPs
But, I'm receive a *lot* of spam like this... (another case abelow) and
I don't no how stop this ...
(sorry , my english is very poor)
<snip>
<DIV><FONT face=3DArial></FONT></DIV><SPAN><A href=3D"http://7g5emg.blu.liv=
efilestore.com/y1pcQCMDJb4PY_kjFJywVsV-OkV-UUYFWGpuXf2GvwbZluUwC2T9DSV38GU1=
AywjI2YcphhAE0eVHnbryJZTrMfcQ/curriculos26.zip?download" target=3D_blank><F=
ONT
face=3DArial>Curriculum...doc</FONT></A><FONTFACE=3DARIAL> =3B<SPAN>=
<FONTCOLOR=3D#C0C0C0>(57=2C8kb)</FONT></SPAN></FONT></SPAN></DIV>
<DIV><FONT face=3DArial>
<snip>
Kai Schaetzl escreveu:
Rejaine Monteiro wrote on Wed, 21 Jan 2009 08:58:21 -0200:
<a target="_blank"
href="http://knut.kumoh.ac.kr/~dojamo/zero/log/attachs.php?id=HU#9123IF";>PRICES.pdf</a>
use a regexp that matches "NOT .pdf" at the end of the hyperlink and ".pdf" in
the
link text.
<a adepth="0" aidx="0"
href="http://knut.kumoh.ac.kr/~dojamo/zero/log/anexos.php?id=GF#590KI";>(106,5KB)</a></p>
Match against ( or , in link text.
Also, you can take advantage of "specialties" in these mails like
target="_blank"
adepth
aidx
~ (user homedir symbol)
I think you would want to score these with 1 or so and not outright "block"
(e.g.
score with 5) as they may produce FPs.
Kai
