[求救]內文過濾破功，怎辦

BigDanny · 一級 註冊時間: 2002-03-20 文章: 27 來自: 中華民國

有一封色情網站的信，每次用內文過濾的方式一直擋不下來，覺得蠻奇怪，於
是把內容仔細一看，文字內容與網址部份全編碼了，而且網址還只是部份編碼
，這樣一來，就算我把網址部份抓下來做內文過濾，只要對方改一下編碼的部
份，就又破功了

　　原址：http://www.buy999.net/happy106
　　編碼：http://ww%77.b%75%79999%2enet/hap%70%79106
可再編成：http://www.b%75%79999%2enet/happ%79106
亦可編成：http://ww%77.b%75%79999.net/hap%70%79106

反正不管怎編，網址就是 http://www.buy999.net/happy106
但我卻無法用內文過濾來阻擋，因為對方只要更改一下編碼就可以了。另外其
它中文部份也都編碼，內文過濾就沒法度了

怎麼辦，有辦法解決嗎？現在垃圾信越來越厲害啦

下面是信件內容
=============================================

From: "李柏宇" <[email protected]>
Subject: GerryMaster
Date: %CURRENT_DATE_TIME
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--=====5984965191711=_"

----=====5984965191711=_
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<html>
<head>GerryMaster
<html>

<head>
<meta http-equiv=3D"Content-Language" content=3D"zh-tw">
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dbig5">
<title>=A6=CA=A6=EC=A8k=A4k=B3=A5=A5~=B6}=B3]=C2=F8=A5=E6=AC=A3=B9=EF =A5=FA=
=A4=D1=A4=C6=A4=E9=B4N=B7F=A4F=B0_=A8=D3 / =A6h=A6=EC=A4k=C0u=C5@=A4h=A4k<=
/title>
</head>

<body>


=A5@=AC=C9=AF=C5AV=A6=AC=C2=C3=AEa=B6=
}=A9=F1=A6=AC=C2=C3AV=AEM=C0\

<a target=3D"_blank" href=3D"http://ww%77.b%75%79999%2enet/hap=
%70%79106">
=A6=CA=A6=EC=A8k=A4=
k=B3=A5=A5~=B6}=B3]=C2=F8=A5=E6=AC=A3=B9=EF =A5=FA=A4=D1=A4=C6=A4=E9=B4N=B7=
F=A4F=B0_=A8=D3 /
=A6h=A6=EC=A4k=C0u=C5@=A4h=A4k=BE=C7=A5=CD=BC=F4=A4k=BD=FC=ACy=A7=B9=A7=CB=
=A4@=A8k 
5=A4j=AA=BE=A6W=A4k=C0u=A1@=AA=F7沢=A4=E5=A4l / =B9a=A4=EC=B3=C2=A9`=
=AC=FC / =A6N=A5=C3 / =C5y / =AD=BB=A4s=B8t=A1@=AD=BA=B3=A1=B5L=BDX=BCv=A4=
=F9 
=B6W=B9=DA=A4=DB=A4k=C0u=BA=EB=BF=EF=AEM=C0\ =A4=E9=A5=BB=A6~=AB=D720=A4j=A4=
k=C0u=A4@=A6=B8=A6=AC=BF=FD =AF=B8=AA=F8=B1j=A4O=B1=C0=C2=CB =A5=FE=A5x=BF=
W=BD=E6 
=BC=F4=A4k=AA=BA=A5=C0=A8=C5=BBP=A7=AE=C4=D6=A4H=A9d=B0M=B0=FC =C1{=A4=EB=B4=
=A9=A5=E6 =A5=C0=A8=C5=BCQ=A5X =C3=E4=B7F=C3=E4=C0=BD=A8=C5=A5=C4 =ABO=C3=D2=
=B3=DC=A8=EC=C3z 
=A5i=B7R=AA=BA=A4=E9=A5=BB=AC=FC=AC=DC =BBP=B6=C2=A4H=A7=A7=BA~=B0=B5=B7R=B9=
=EA=BF=FD / =B6=C2=A4H=A5=A8=B4=D2=A8g=B4=A1=A4p=B9=E0=A5=DE =A5~=A5[=C5=E9=
=A4=BA=AEg=BA=EB 
=A4=E9=A5=BB=BA=F4=A4=CD=B2=BC=BF=EF=B2=C4=A4@=AB=FC=A6W=A4k=C0u =A1=B7 =B7=
R=A5=D0=A5=D1=A1=B7 =B0=B5=B7R=A7=DE=A5=A9=BBP=BAt=A7=DE=B5L=A5i=ACD=B1=A7=
=AA=BA=A9=CA=B7P=A4=D7=AA=AB 
=AC=FC=A4=E9=B5L=BDX=A5d=B3q =B9q=AA=B1=A4H=AA=AB =A4@=AF=EBA=A4=F9=B8=CC=AC=
=DD=A4=A3=A8=EC=AA=BA=B1=A1=B8` =A5u=A6=B3=A6b=A5d=B3qA=A4=F9=AC=DD=AA=BA=A8=
=EC=AD=F2 
G=B8n=AAM=A5H=A4W=A5i=B7R=A9=CA=B7P=AC=FC=A4k=A4@=A6=B8=A6=AC=BF=FD / =A8C=
=B3=A1=AC=D2=ACO=A5=AB=B0=E2=BA=EB=BF=EF=A4=A4=AA=BA=BA=EB=BF=EF =BD=D0=A4=
=C5=BF=F9=B9L 
2006=A6~=B3=CC=B7s =B6W=C4=D0=B7=C3 =AD=AB=A4f=A8=FD =A6=E8=A4=E8=BB=B6=A9=
f =AC=FC=A8=C5=C2=BC=C1v =AD=C8=B1o=A6=AC=C2=C3 
=B2]=B6=C3=AEa=B1=DA=C2=F8=A5=E6=B9=EA=BF=FD =ABO=C3=D2=AFu=B9=EA=BAt=A5X =
/ =A8=E0=A4l=B7F=A5=C0=BF=CB =B7=DD=B7=DD=B7F=AE]=A4k =AD=F4=AD=F4=B7F=A9f=
=A9f 
=A6h=A4k=A6P=AE=C9=B1j=AB=C1=A4@=A8k / =A6=CA=A4H=A6P=AE=C9=A9=CA=B7R=B2V=BE=
=D4 =B3=F5=AD=B1=A7=A7=C6[ 
=C5=DC=BAA=B7=F6=BA~=A6b =B9q=A8=AE =B7n=C0Y=A9=B1 =AE=FC=A4=F4=AFD=B3=F5 =
=A4W=B1M=ACD=A8}=AEa=B0=FC=A4k / =A6h=A6W=B7=F6=BA~=BB=F4=A4W=BD=FC=AB=C1 =
=C3C=AD=B1=C5=E9=A4=BA=B6=C3=AEg=A4@=B3q 
=A4=E9=A5=BB=A8=E2=A4j=AA=BE=A6W=A4k=C0u =AF=F3=B2=F9=A4=FB=A5=A4 / =A4=CE=
=A4t=A9`=A5=A1 =B5L=BDX=BCv=A4=F9 =A5[=C3=D85=B3=A1=A5x=C6W=A4k=C0u =C6[=A4=
=EB=C2=FA=A4D</a>

<a target=3D"_blank" href=3D"http://ww%77.b%75%79999%2enet/hap=
%70%79106">

=AB=F6=A6=B9=ADq=C1=CA =B5L=BDX=A5~=ACy=
=BA=EB=BF=EF 20=A4=F9DVD =A8=E5=C2=C3=AA=A9=AEM=C0\</a>=



<a target=3D"_blank" href=3D"http://ww%77.b%75%79999%2enet/hap=
%70%79106">
=A5u=ADn1550=
=A4=B8=B3=E1</a>

</body>

</html>

GerryMaster

=A1@

wenchi · 發表於: 星期四五月 18, 2006 10:27 am 文章標題:

真服了垃圾業者的功力。

BigDanny · 發表於: 星期四五月 18, 2006 11:41 am 文章標題:

最近這種廣告信越來越多，造成垃圾信擋信率越來越低
很煩惱

Arnor · 發表於: 星期四五月 18, 2006 1:41 pm 文章標題:

這種信用反查都可以找出來.

to BigDanny:
試試這條 PCRE 條件

((W)|(w)|(%77)|(%57))((W)|(w)|(%77)|(%57))((W)|(w)|(%77)|(%57))((.)|(%2e))((B)|(b)|(%42)|(%62))((U)|(u)|(%55)|(%75))((U)|(u)|(%59)|(%79))((9)|(%39))((9)|(%39))((9)|(%39))((.)|(%2e))

基本上我個人認為前面的 www 是比較無意義的,
所以也可去掉前面的 www 的條件

((B)|(b)|(%42)|(%62))((U)|(u)|(%55)|(%75))((U)|(u)|(%59)|(%79))((9)|(%39))((9)|(%39))((9)|(%39))((.)|(%2e))
_________________
*若是想問問題的話, 請務必不要塗改任何 IP, 網域資料, 您若不願貼上IP或網域, 請改以電子郵件來詢問. 謝謝您的配合.*
*若是回報疑似軟體的運行或邏輯或資料處理有誤的問題, 小弟很樂意去了解您的情況, 但請務必以最新版來做回報, 如果以郵件詢問, 請參考 http://www.raidenmaild.com/tw/feedback.html 的說明, 最好標題加個 RaidenMAILD 字樣, 才不致會遺漏了您的信唷. 謝謝您的配合^^*
*在版上發文請遵守網路禮儀, 並請持著虛心敘述問題請教他人, 凡發現違反的文, 均一律刪除為優先, 不另行通知喔.
*與使用者教學相長腦力激盪是我輩成就感的來源, 誠心希望您能不吝指教.
*雷電MAILD 知識庫文件 http://www.raidenmaild.com/tw/kb/

素還尊
Team John Long.
Email: [email protected]
公司網站 http://www.raidenmaild.com/company/

BigDanny · 發表於: 星期四五月 18, 2006 2:12 pm 文章標題:

謝啦！我回去試試