On Friday, February 11, 2005, 8:51:46 AM, Darin wrote: DC> Most of what slips through our filters is exactly this. Unfortunately I DC> know of no way to block this short of reacting to the first one seen and DC> adding a body filter for the URL...the same thing Message Sniffer or any DC> SURBL list would do.
DC> I'm add maybe 1-4 of these per day. DC> Sometimes there's enough other text for additional body filters, which can DC> cut down on the number of edits. This is an area we concentrate on... usually these kinds of campaigns have some kind of script running behind them. If we can reverse engineer the scripting (by reviewing many copies) then we can create a compound rule that matches enough static components to avoid legit messages and block all (or most) of the variants of the spam campaign. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
