<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-15"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<blockquote type="cite">
<div>I believe that I have also been greatly troubled by the same
messages. The common thread to these messages is what I call an
obfucated URL where the URL has spaces in multiple places. I created a
cf file in /etc/mail/spmassassin directory and wrote my first
spamassassin rule. It might not be the best but it is working for me.
Basically, the rule matches a URL that starts with www. followed by a
space followed by some text ending in a period like pill45. followed by
another space then a TLD like com, net or org. I started with a small
score for testing but have significantly raised the score to 4.5 now.</div>
<div> </div>
<div># Rule to find URLs with spaces<br>
body ASDM_OBF_URL /www\.\s(.+?)\s[A-Za-z]{2,4}/i<br>
score ASDM_OBF_URL 4.5<br>
describe ASDM_OBF_URL URLs with spaces<br>
</div>
<div>I haven't seen any false positives yet.</div>
<div> </div>
<div>Gary Faith</div>
</blockquote>
<br>
Gary<br>
<br>
This one rocks!<br>
<br>
Got them one hundred per cent<br>
<br>
Thank you to all<br>
<br>
Best regards<br>
<br>
Alessandro Bianchi<br>
<div class="moz-signature">-- <br>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-15">
<meta http-equiv="Content-Style-Type" content="text/css">
<title></title>
<style type="text/css">
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 13.0px}
p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: center; font: 13.0px Helvetica; color: #c96523}
p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: center; font: 12.0px Helvetica; min-height: 13.0px}
p.p4 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: center; font: 12.0px Helvetica; color: #3920c3}
p.p5 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; color: #979797; min-height: 13.0px}
p.p6 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; color: #979797}
span.s1 {color: #376cc4}
span.s2 {color: #000000}
</style>
<p class="p1"><br>
</p>
<p class="p2"><span class="s1"><b>SKYNET S.r.l.</b></span><span
class="s2"> -<span class="Apple-converted-space"> </span></span><b>Piazza
XXV
Aprile
14<span class="Apple-converted-space"> </span>- 28021
Borgomanero (No)</b></p>
<p class="p3"><br>
</p>
<p class="p4"><b>tel.<span class="Apple-converted-space"> </span>+39
0322-836487/834765 - fax <span class="Apple-converted-space"> </span>+39
0322-836608
-<span class="Apple-converted-space"> </span><a
class="moz-txt-link-abbreviated" href="http://www.skynet-srl.com">www.skynet-srl.com</a></b></p>
<p class="p1"><br>
</p>
<p class="p5"><br>
</p>
<p class="p6">Autorizzazione Ministeriale n.197</p>
<p class="p5"><br>
</p>
<p class="p6">Le<span class="Apple-converted-space"> </span>informazioni<span
class="Apple-converted-space"> </span>contenute in<span
class="Apple-converted-space"> </span>questo messaggio sono
riservate e confidenziali ed è<span class="Apple-converted-space"> </span>vietata
la
diffusione
in qualunque modo<span class="Apple-converted-space"> </span>eseguita.
Qualora
Lei non fosse la persona a<span class="Apple-converted-space"> </span>cui
il
presente messaggio<span class="Apple-converted-space"> </span>è
destinato, La invitiamo ad<span class="Apple-converted-space"> </span>eliminarlo
e
a<span class="Apple-converted-space"> </span>non leggerlo,
dandocene gentilmente comunicazione. Per qualsiasi informazione si
prega di contattare (e-mail dell’azienda). Rif. D.L. 196/2003</p>
</div>
</body>
</html>