From: Brian Ipsen > > The number of messages like below has increased. Unfortunately, > they are not reported to SpamCop fast enough for SURBL to handle > them.... Has anyone created some sort of filter to identify this > type of messages ?? > > <STYLE></STYLE> > </HEAD> > <BODY bgColor=#ffffff> > <DIV> </DIV> > <DIV><A href="link">link to site</A></DIV> > <DIV> </DIV> > <DIV style="FLOAT: left;"><FONT > face=Courier>Me<BR>Xa<BR>Ul<BR>Am<BR><STRONG>Ci</STRONG><BR>Le > <BR><STRONG>Va > </STRONG><BR>Pr<BR><STRONG>Vi</STRONG><BR>Ce</FONT></DIV> > <DIV style="FLOAT: left;"><FONT > face=Courier>ri<BR>na<BR>tr<BR>bi<BR><STRONG>al</STRONG><BR>vi > <BR><STRONG>li > </STRONG><BR>op<BR><STRONG>ag</STRONG><BR>le</FONT></DIV> > <DIV style="FLOAT: left;"><FONT > face=Courier>di<BR>x<BR>am<BR>en<BR><STRONG>is</STRONG><BR>tr< > BR><STRONG>um< > /STRONG><BR>ec<BR><STRONG>ra</STRONG><BR>br</FONT></DIV> > <DIV style="FLOAT: left;"><FONT > face=Courier>a<BR><BR><BR><BR> 1.<BR>a<BR> 3.<BR>ia< > BR> 3.<BR > >ex</FONT></DIV> > <DIV style="FLOAT: left;"><FONT > face=Courier><BR><BR><BR><BR>21<BR><BR>75<BR><BR>33<BR></FONT></DIV> > </BODY></HTML>
I just did this: rawbody BUC_FLOAT /<DIV style="FLOAT:/ score BUC_FLOAT 1 I scored it at "1" because I wasn't sure about false positives. The blacklists and SURBL catch most of them now, so I never bothered to up the score. I haven't done any detailed research, but I do notice that all but one of the mails that hit this rule in the last week also hit URIBL_SBL or one of the SURBL rules, so it doesn't seem to produce too many false positives (at least in my environment). Bowie
