[Mimedefang] Off-topic: Viagra SPAM question
Kevin A. McGrail
kmcgrail at pccc.com
Mon Nov 7 12:35:11 EST 2005
I was just wondering if anyone out there has come up with a good way of
dealing with the spam with content in a table that spells the words like:
<td>K X X</td>
<td>A X X</td>
<td>M X X</td>
Currently, I'm just using this rule because they seem to be abusing tripod
but it seems too manual for my tastes:
#VIAGRA AD
body __KAM_VIAGRA1 /[VACXP] [VACXP] [VACXP] [VACXP] [VACXP]
[VACXP]/
describe __KAM_VIAGRA1 Partial rule for Common Viagra Table Trick
uri __KAM_VIAGRA2 /tripod.com/
describe __KAM_VIAGRA2 Partial rule for Common Viagra Table Trick
meta KAM_VIAGRA __KAM_VIAGRA1 && __KAM_VIAGRA2
describe KAM_VIAGRA Common Viagra Table Trick
score KAM_VIAGRA 5.0
Thoughts?
KAM
More information about the MIMEDefang
mailing list