[Mimedefang] How can I stop these annoying emails?

Tue Feb 24 22:49:55 EST 2004

On Tue, 24 Feb 2004, Matthew Rossiter wrote:

> I can't seem to stop these emails.  The come from all over the place and
> they always contain something like this.
>
> <html><body>
> <center><!--3urd0O7Akb1F7yR--><a href="http://www.jupitrrj.com"><img
> src="http://www.along5tr.com/v9.gif" border=0></a></center>
> <body></html>

   I used to get those all the time, and I got rid of them with a
SpamAssassin rule.  There is enough of a common thread to finger them.
Notice they will all have the <center> tag, then the comment start, then
10-12 random alphanumeric characters, then an href, then an IMG tag to a
URL that always ends with a filename consisting of a letter then a number
then .gif, then the border and closing center tags, all in one line.  The
rule I used was (this is all one line, in case your client word wraps):

UAH_VIAGRA_IMAGE /^<center><\!--[a-zA-Z0-9]{10,20}--><a href=.+><img src=.+\/[a-z][1-9]\.gif\" border=0><\/a><\/center>$/i

then scored it high enough to cause a reject.  Haven't seen one of these
in weeks.

   HTH...

Jim McCullars
University of Alabama in Huntsville