[Mimedefang] Off-topic: Viagra SPAM question

Kevin A. McGrail kmcgrail at pccc.com
Mon Nov 7 12:35:11 EST 2005


I was just wondering if anyone out there has come up with a good way of
dealing with the spam with content in a table that spells the words like:

<td>K X X</td>
<td>A X X</td>
<td>M X X</td>

Currently, I'm just using this rule because they seem to be abusing tripod
but it seems too manual for my tastes:

#VIAGRA AD
body            __KAM_VIAGRA1   /[VACXP] [VACXP] [VACXP] [VACXP] [VACXP]
[VACXP]/
describe        __KAM_VIAGRA1   Partial rule for Common Viagra Table Trick
uri             __KAM_VIAGRA2   /tripod.com/
describe        __KAM_VIAGRA2   Partial rule for Common Viagra Table Trick
meta            KAM_VIAGRA     __KAM_VIAGRA1 && __KAM_VIAGRA2
describe        KAM_VIAGRA     Common Viagra Table Trick
score           KAM_VIAGRA     5.0

Thoughts?

KAM




More information about the MIMEDefang mailing list