I'd probably use something like (untested, but it should work) uri LOCAL_RID /\?rid=\d/ describe LOCAL_RID Has a possible remove id score LOCAL_RID 0.01
and then adjust based on whether or not it's doing what you want. You could be more specific (for instance, limiting it to com|net|org|info), but then when they start coming from .biz you have to adjust. On Thu, 15 Jan 2004, Brian Ipsen wrote: > Hi! > > I'm no expert in regular expressions, but a bunch of the spam I've received > recently has a link like this: > > http://www.takrr.com?rid=1097 > > What would a rule look like to match a pattern like (I've read a little > about matching, but not enough to get it working): > > http://(anything).(com|net|org|info)?rid=[0-9]{1,5} > > ??? > > Regards > > /Brian > > > ------------------------------------------------------- > The SF.Net email is sponsored by EclipseCon 2004 > Premiere Conference on Open Tools Development and Integration > See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. > http://www.eclipsecon.org/osdn > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > -- Adam Lopresto http://cec.wustl.edu/~adam/ And entropy continued to increase. ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
