Arvid Ephraim Picciani wrote:
> Heya,
>
> wondering if somone got a rule for those.
> For me it's too low volume to care.
> see attached mail.
>
> The sender isn't on any BL yet (might be in a few hours) , but the URL is
> already on uribl.com. SA doesn't detect the "obfuscation" unfortunatly.
> The bayes poison begins to be very common, so i wonder when SA will be able to
> differ between content and noise.
> the obfuscation of the drug name is quite funny so it might at least be
> usefull for some office-fun
>
>



The following was posted on the SARE list.

On Fri, 4 Jul 2008, at 15:55, Pete Fuggle wrote:


> > body __OPEN_YOUR_BROWSER /\bOpen your browser\b/
> > body __BI_CAPS_URL /http:\/\/.*\[[A-Z][A-Z]\]com/
> > body __REPLACE_BI_CAPS /\bReplace \"[A-Z][A-Z]\" with \"\.\"/
> > meta FASTBREAK_20080704 (__OPEN_YOUR_BROWSER && __BI_CAPS_URL &&
> > __REPLACE_BI_CAPS)
> > score FASTBREAK_20080704 10.0

>


I guess the .* could be replaced by .{1,20}