John, the current version doesn't trap that type of URI and that's why I am using the older version and mentioned it.
I have collected 13 examples of obfuscated URIs that I can send you. Mike ----- Original Message ----- From: "John Hardin" <jhar...@impsec.org> To: "Mike Wallace" <m...@mlrw.com> Cc: "twofers" <twof...@yahoo.com>, users@spamassassin.apache.org Sent: Monday, July 27, 2009 4:48:52 PM GMT -05:00 US/Canada Eastern Subject: Re: {SPAM?} Rules On Mon, 27 Jul 2009, Mike Wallace wrote: > I found the only ruleset that catches this to be: > > http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf?revision=795578 > > > And then only the last two rules fired. That's old. Lose the ?revision... bit to see the current version. -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- Ignorance doesn't make stuff not exist. -- Bucky Katt ----------------------------------------------------------------------- 9 days until the 274th anniversary of John Peter Zenger's acquittal This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.