Sven Riedel wrote:
> Hi,
> I'm getting a bit of HTML spam with lines like
>
> right" face=Arial> w </FONT>
>
> To catch this style of obfuscation, I did two rules,
> being unsure how to escape the carets:
>
> rawbody htmlobscu1 /\>\s*\w\s*\<\//
> rawbody htmlobscu2 />\s*\w\s*<\//
>
> both with scores and descriptions of course. But neither
> rule seems to be hitting. What am I doing wrong?
Hmm... from the looks of it, htmlobscu2 should work.
In the original source, are there any line-breaks in the sequence?
ie:
right" face=Arial> w
</FONT>
|