> -----Original Message----- > From: Michael W. Cocke [mailto:[EMAIL PROTECTED] > Sent: Wednesday, July 23, 2003 7:43 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Rule problem > > > Everytime I think I'm starting to understand this thing... GRRRRR. > > Could come kind person tell me what I'm doing wrong? As near as I can > figure, this rule - > > body IPURL /http:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/i > describe IPURL Received has URL link to IP address > score IPURL 6 > > Should stop a message containing > > http://123.456.789.101 > > but it doesn't seem to. (Yes, my threshold is below 6). > > Thanks! > > Mike- >
I believe it should be a URI or rawbody rule. I don't think it will work with body. Also I believe there already is a rule for this in standard distro. a great rule I wrote is like this but looking for the % OBFU rawbody MY_PERCENT_OBFU /\%..\%..\%../i describe MY_PERCENT_OBFU Tries to OBFU link with % signs score MY_PERCENT_OBFU 1.55 ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here: http://www.vmware.com/wl/offer/345/0 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
