procmail
[Top] [All Lists]

Re: regex syntax question

2004-03-02 14:21:02
On Tue, 2 Mar 2004, Curtis Maurand wrote:

CM> The latest way that I've seen it done is by completely obfuscating the
CM> link by encoding it as "http:&#47&#47..."
CM> which translates to "http://...";  I'm still working on the search for
CM> that, though it only looks like I need to escape the "pound" (#)
CM> signs; \#, which I've done and haven't seen any email like that since
CM> yesterday.
CM>

I have a 10% rule on that one:

# 10% of chars are &#
:0 BD
* -1^1 .
* 10^1 [&#]
action as spam line here


-- 
Alan


( Please do not email me AS WELL as replying to the list.  Please
  address personal email to alan+1@ as lists@ is not read. A
  password autoresponder may be invoked if this email is very old. )


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>