I was just wondering if anyone out there has come up with a good way of
dealing with the spam with content in a table that spells the words like:

<td>K X X</td>
<td>A X X</td>
<td>M X X</td>

Currently, I'm just using this rule because they seem to be abusing tripod
but it seems too manual for my tastes:

#VIAGRA AD
body            __KAM_VIAGRA1   /[VACXP] [VACXP] [VACXP] [VACXP] [VACXP]
[VACXP]/
describe        __KAM_VIAGRA1   Partial rule for Common Viagra Table Trick
uri             __KAM_VIAGRA2   /tripod.com/
describe        __KAM_VIAGRA2   Partial rule for Common Viagra Table Trick
meta            KAM_VIAGRA     __KAM_VIAGRA1 && __KAM_VIAGRA2
describe        KAM_VIAGRA     Common Viagra Table Trick
score           KAM_VIAGRA     5.0

Thoughts?

KAM

_______________________________________________
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list
[email protected]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

Reply via email to