# Mr Wiggly rule.
# Specific to a certain type of spammer that often uses only an image for V-Drug
# Also hits an anti-aging drug spam by the same spammer.
# Chris Santerre
# SARE rule 03/29/03
# www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm

rawbody __VDRUG1 /^\<html\>\<body\>/
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a href\=\"http\:\/\//
rawbody __VDRUG3 /[a-zA-Z]{0,2}\d{0,2}\.(?:jpg|gif)\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
describe MRWIGGLY Mr. Wiggly enhance drug spam.
score MRWIGGLY 5.0 #score to taste

rawbody __VDRUG5 /^\<\/font\>/
rawbody __VDRUG6 /^\<\/html\>\<\/body\>/
rawbody __VDRUG7 /[a-zA-Z]{0,5}\d{0,2}\.(?:jpg|gif)\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG8 /[a-zA-Z]{0,6}\d{0,3}\.(?:jpg|gif)\" height\=\"\d{1,3}\" width\=\"\d{1,3} border\=(?:\"\"|0)\>\<\/a\>\<\/center\>/
meta MRWIGGLY2 (__VDRUG1 && __VDRUG2 && __VDRUG5 && __VDRUG6 && (__VDRUG7 || __VDRUG8))
describe MRWIGGLY2 Mr. Wiggly 2 enhance drug spam.
score MRWIGGLY2 4.0 #score to taste