Opps - this should have gone to the list. Sorry. Adam Katz wrote: > Before I help you with your shell and regex issues, I should point out > that this is not a very strong rule. It will hit ham. SNIP > > Better solution: put some examples up on a pastebin and link them to > us so we can help you find more diagnostic (and simpler) patterns to > nail them with.
Thanks (also to Martin who replied). I posted one of the spams here: http://pastebin.com/9aBAxR7m You can see the long series of break codes in it. Sorry for the confusion on the 10.10.10.10 - that isn't part of the spam, it was just a handy file for testing since it had a repeating string in it. I did get it to work from the CLI, and wrote the following rule: body CBJ_GiveMeABreak /\["<br>"]{5,}/ describe CBJ_GiveMeABreak Messages with multiple consecutave break characters score CBJ_GiveMeABreak 0.01 I know it may trigger on some ham which is why I set the initial score to 0.01. Better ideas are most welcome though! Thanks much... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500
