Hi back, Now we have a problem because the spam is something like www meds88 com www . meds88 . com and the rule is working fine, and now it stoped at: www. meds88. com Can you try now: body AE_MEDS35 /\bwww(?:\s\W?\s?|\W\s)\w{3,6}\d{2,6}(?:\s\W?\s?|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i describe AE_MEDS35 obfuscated domain seen in spam score AE_MEDS35 3.00 which should catch it... Thanks, Greetings and nice Day/Evening Michelle Konzack Systemadministrator Tamay Dogan Network Debian GNU/Linux Consultant -- Linux-User #280138 with the Linux Counter, http://counter.li.org/ ##################### Debian GNU/Linux Consultant ##################### <http://www.tamay-dogan.net/> Michelle Konzack <http://www.can4linux.org/> c/o Vertriebsp. KabelBW <http://www.flexray4linux.org/> Blumenstrasse 2 Jabber linux4michelle@jabber.ccc.de 77694 Kehl/Germany IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947 ICQ #328449886 Tel. FR: +33 6 61925193
Attachment:
signature.pgp
Description: Digital signature