On Mon, 23 Feb 2004, David Prestwich <[EMAIL PROTECTED]> wrote: > The emails are the viagra, xanax, and valium ones with variants on this > subject line: FWD: All Meds Here. [EMAIL PROTECTED] = X+A+Nax . Va1ium , Fi`0ric3t > \ So|m|a * .Pntermin. TBSJO
There's Matt Ketler's antidrug.cf ruleset for SA you could try; it is in development and not super comprehensive yet, but catches some of mine: http://mywebpages.comcast.net/mkettler/sa/antidrug.cf Like David said, you can use that web-based tool to produce SA rules that will catch every kind of obfuscation under the sun for a given input string. But have you seen the output? I've been wondering about the performance hit I'd take for just a few of the common drugs. -- Brent J. Nordquist <[EMAIL PROTECTED]> N0BJN Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
