There's been a rule circulating this mailing list for a couple of weeks.
This is the latest edition to catch those med-things (afaik).
----------
body AE_MEDS35 /\bwww\s(?:\W\s)?\w{3,6}\d{2,6}\s(?:\W\s)?(?:c\s?o
\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
describe AE_MEDS35 obfuscated domain in message
score AE_MEDS35 5.0
----------
It works good for me.
With regards
Kasper
On Thu, 2009-06-25 at 09:19 +0100, Andrew Hearn wrote:
> Hello,
>
> I'm wondering if I'm missing some rules that would have given this
> message more points - I know it's missing bayes (I'm not sure why as our
> servers should use bayes, but it seems not to have been run for this
> message.)
>
> http://www.pastebin.ca/1473975
>
> Thanks
>
