On Wed, 15 Jul 2009, John Hardin wrote:
On Wed, 15 Jul 2009, MrGibbage wrote:
I just got one a few minutes ago that had a link like this:
www[dot]da39[dot]com
and yes, that is a "quote". They actually obfuscated the . with [dot]
Anyone ready to tackle that one?
The link below has been updated for that, I'm working on refinements right
now.
Refinements checked in. Comments solicited.
Second rule overlaps the first, the first rule will likely not be
developed any further.
http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Mine eyes have seen the horror of the voting of the horde;
They've looted the fromagerie where guv'ment cheese is stored;
If war's not won before the break they grow so quickly bored;
Their vote counts as much as yours. -- Tam
-----------------------------------------------------------------------
Tomorrow: the 64th anniversary of the dawn of the Atomic Age
