| 
	
 Trinidad, 
src="http   is way to general a block.  For example, just about everything you get from Microsoft will get blocked by this (which may or may not be a bad thing).  I have worked with several iterations of this kind of block.  I am still changing them as I gather more statistics but here is my latest: 
The first on gets rid of url's using "Dotted IP" notation rather than FQDN's.  This can be dangerous but we have taken the stance that if you can't put a DNS host name on it, we don't want it. 
(href=" http://+[\d" CLASS="ASPForums" TITLE="WARNING: URL created by poster.  -  http://+" CLASS="ASPForums" TITLE="WARNING: URL created by poster.  - http://+ [\d]) 
This one detects http OR 3dhttp  Then //  Then 0 - 15 of ANY character Then a % OR an @  followed by just about anything. 
 ((http|3dhttp)://.{0,15}( mailto:%|@)[(\d|\w" CLASS="ASPForums" TITLE="WARNING: URL created by poster.  - %|@)[(\d|\w )]) 
While they don't drop all the "remote" refs, they are doing an excellent job with very few "False Positives" 
Hope this helps. 
Dan S. 
  
  
          |