URLs with Spaces

[Andrew Hearn <an...@aaisp.net.uk>]

Hello,

I'm wondering if I'm missing some rules that would have given this
message more points - I know it's missing bayes (I'm not sure why as our
servers should use bayes, but it seems not to have been run for this
message.)

http://www.pastebin.ca/1473975

Thanks

-- 
Andrew.

Re: URLs with Spaces

[Andrew Hearn <an...@aaisp.net.uk>]

Kasper Sacharias Eenberg wrote:
> There's been a rule circulating this mailing list for a couple of weeks.
> This is the latest edition to catch those med-things (afaik).
> 
> ----------
> body     AE_MEDS35 /\bwww\s(?:\W\s)?\w{3,6}\d{2,6}\s(?:\W\s)?(?:c\s?o
> \s?m|n\s?e\s?t|o\s?r\s?g)\b/i
> describe AE_MEDS35 obfuscated domain in message
> score    AE_MEDS35 5.0
> ----------
> 
> It works good for me.
> 


Thanks Kasper,

Also the Sanesecurity sigs for Clam catch it (thanks to Steve)

Re: URLs with Spaces

[Kasper Sacharias Eenberg <ks...@hovmark.dk>]

There's been a rule circulating this mailing list for a couple of weeks.
This is the latest edition to catch those med-things (afaik).

----------
body     AE_MEDS35 /\bwww\s(?:\W\s)?\w{3,6}\d{2,6}\s(?:\W\s)?(?:c\s?o
\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
describe AE_MEDS35 obfuscated domain in message
score    AE_MEDS35 5.0
----------

It works good for me.

With regards
Kasper


On Thu, 2009-06-25 at 09:19 +0100, Andrew Hearn wrote:
> Hello,
> 
> I'm wondering if I'm missing some rules that would have given this
> message more points - I know it's missing bayes (I'm not sure why as our
> servers should use bayes, but it seems not to have been run for this
> message.)
> 
> http://www.pastebin.ca/1473975
> 
> Thanks
>