IT's my
monthly posting of MRWIGGLY :-)
rawbody
__VDRUG1 /^\<html\>\<body\>/
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a href\=\"http\:\/\//
rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
describe MRWIGGLY Mr. Wiggly enhance drug spam.
score MRWIGGLY 1.0
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a href\=\"http\:\/\//
rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
describe MRWIGGLY Mr. Wiggly enhance drug spam.
score MRWIGGLY 1.0
Not a single
FP ever. EVER!!!! (I need a vaca)
--Chris
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday, February 18, 2004 1:55 PM
To: [EMAIL PROTECTED]
Subject: New one that's slipping through
I've noticed quite a few of these that are slipping through. It only contains a gif and it only scores either 1.861 or 1.961. Any ideas on how to catch these types that are only gif's.
Thanks
Andy
"not spam, SpamAssassin (score=1.861, required 7.5,
HTML_60_70 0.10,
HTML_IMAGE_ONLY_02 1.50,
HTML_MESSAGE 0.00,
HTML_TAG_BALANCE_BODY 0.26,
RM_rb_ANCHOR 0.00,
RM_rb_BODY 0.00,
RM_rb_HTML 0.00)"
"
------=_NextPart_000_04B4_D9D4D8C4.9140F91A
Content-Transfer-Encoding: 8bit
Content-Type: text/html;
charset="us-ascii"
<html><body>
<center><!--yse1eAkvguERrya--><a href=""><img src="" border=0></a></center>
<body></html>
"
"not spam, SpamAssassin (score=1.961, required 7.5,
HTML_60_70 0.10,
HTML_IMAGE_ONLY_02 1.50,
HTML_MESSAGE 0.00,
HTML_TAG_BALANCE_BODY 0.26,
RM_rb_ANCHOR 0.00,
RM_rb_BODY 0.00,
RM_rb_HTML 0.00,
RM_sl_Parens 0.10)"
"
------=_NextPart_000_0CE6_A3D9D3B8.043D9DD1
Content-Transfer-Encoding: 8bit
Content-Type: text/html;
charset="us-ascii"
<html><body>
<center><!--rwhsoMlzePZw9d3--><a href=""><img src="" border=0></a></center>
<body></html>
"
