> I've just received a new version of the same old message which was missed > by the Mr Wiggly rules. > > Message source here: http://www.mailsecurity.net.au/tmp/mrwiggly.txt
Persistant little swine this one... The following works nicely for me and has generated no false positives yet (hence the high score), YMMV: # Look for URIs linking to a .GIF or .JPG with one or two letters # then one or two numbers as the name uri AMB_IMAGE_CONTENT /\/[a-z][a-z]?[0-9][0-9]?\.(gif|jpg)/i describe AMB_IMAGE_CONTENT Contains URI linking to numbered GIF or JPG score AMB_IMAGE_CONTENT 3.0 Andy
