Tiny text only spam (semi OT)

[Bernard Lheureux]

Alessandro Bianchi wrote:
Gosh, they found the way to bypass this rule:

I received these this night (2 different messages containig this):

in the 1st: Can Exercise Bodost Your sex rDive?.www .za16. com
in the 2nd: Save oYur Relationship With These Amazing Secerts: www,nu26,com

Has anyone a solution to avoid these kind of spams ?
>> I believe that I have also been greatly troubled by the same 
>> messages. The common thread to these messages is what I call an 
>> obfucated URL where the URL has spaces in multiple places. I created 
>> a cf file in /etc/mail/spmassassin directory and wrote my first 
>> spamassassin rule. It might not be the best but it is working for me. 
>> Basically, the rule matches a URL that starts with www. followed by a 
>> space followed by some text ending in a period like pill45. followed 
>> by another space then a TLD like com, net or org. I started with a 
>> small score for testing but have significantly raised the score to 
>> 4.5 now.
>> # Rule to find URLs with spaces
>> body ASDM_OBF_URL /www\.\s(.+?)\s[A-Za-z]{2,4}/i
>> score ASDM_OBF_URL 4.5
>> describe ASDM_OBF_URL URLs with spaces
>> I haven't seen any false positives yet.
>> Gary Faith
>
> Gary
>
> This one rocks!
>
> Got them one hundred per cent
>
> Thank you to all
>
> Best regards
>
> Alessandro Bianchi
> -- 
>
>
> *SKYNET S.r.l.* - *Piazza XXV Aprile 14 - 28021 Borgomanero (No)*
>
>
> *tel. +39 0322-836487/834765 - fax +39 0322-836608 - www.skynet-srl.com*
>
>
>
> Autorizzazione Ministeriale n.197
>
>
> Le informazioni contenute in questo messaggio sono riservate e 
> confidenziali ed è vietata la diffusione in qualunque modo eseguita. 
> Qualora Lei non fosse la persona a cui il presente messaggio è 
> destinato, La invitiamo ad eliminarlo e a non leggerlo, dandocene 
> gentilmente comunicazione. Per qualsiasi informazione si prega di 
> contattare (e-mail dell’azienda). Rif. D.L. 196/2003
>