--On Tuesday, February 24, 2004 3:51 PM -0800 Matthew Rossiter <[EMAIL PROTECTED]> wrote:
I can't seem to stop these emails. The come from all over the place and they always contain something like this.
<html><body> <center><!--3urd0O7Akb1F7yR--><a href="http://www.jupitrrj.com";><img src="http://www.along5tr.com/v9.gif"; border=0></a></center> <body></html>
More of a Spamassassin thing. The messages might be qp or base64 too, and SA takes care of that.
This is pretty good (our local mods start CU_):
# Links to image from web
rawbody CU_IMAGELINK_WEB /<a href=[^>]{6,80}>\s{0,80}<img [^>]{0,40}http/i
describe CU_IMAGELINK_WEB Click on an image on the web
score CU_IMAGELINK_WEB 1.0
# Links to image from web, and that is the entire message meta CU_IMAGELINK_ONLY CU_IMAGELINK_WEB && HTML_IMAGE_ONLY_02 describe CU_IMAGELINK_ONLY Click on an image on the web, and that's all score CU_IMAGELINK_ONLY 4.0
Joseph Brennan Academic Technologies Group, Academic Information Systems (AcIS) Columbia University in the City of New York
_______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
![http://www.along5tr.com/v9.gif"](http://www.along5tr.com/v9.gif"){kind=link}