This hits everytime:
rawbody __VDRUG1 /^\<html\>\<body\>/
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a href\=\"http\:\/\//
rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
describe MRWIGGLY Mr. Wiggly enhance drug spam.
score MRWIGGLY 2.0
--Chris
> -----Original Message-----
> From: Matthias Fuhrmann
> [mailto:[EMAIL PROTECTED]
> Sent: Saturday, February 07, 2004 8:06 PM
> To: [EMAIL PROTECTED]
> Subject: html image only
>
>
>
> Hi,
>
> another anyoing spammer:
>
> <html><body>
> <center><!--sriwQlj8pV75--><a
> href="http://www.sortffr.com";><img
> src="http://www.rockedce.com/v9.gif"; border=0></a></center>
> <body></html>
>
> 3 lines.
> didnt got hit hard enough yet, only 6.5 points (requiered 5).
> anyone seen this yet and got more examples, or might write a regex ?
>
> tia,
> Matthias
>
![http://www.rockedce.com/v9.gif"](http://www.rockedce.com/v9.gif"){kind=link}