Howdy Kai,
That tripped Chris Santerre's "Mr. Wiggly" rule.
rawbody __VDRUG1 /^\<html\>\<body\>/
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a
href\=\"http\:\/\//
rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
describe MRWIGGLY Mr. Wiggly enhance drug spam.
score MRWIGGLY 1.0
(Yes, I realize that wasn't exactly your question, but still...)
-tom
-----Original Message-----
From: Kai Schaetzl [mailto:[EMAIL PROTECTED]
Sent: Saturday, February 28, 2004 9:32 AM
To: [EMAIL PROTECTED]
Subject: No tagging of comments?
The only spam getting thru our SA from time to time is of this format:
