> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Brian Ipsen
> Sent: Thursday, January 15, 2004 4:23 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Help needed with url rule
>
> Hi!
>
> I'm no expert in regular expressions, but a bunch of the
> spam I've received
> recently has a link like this:
>
> http://www.takrr.com?rid=1097
>
> What would a rule look like to match a pattern like (I've
> read a little
> about matching, but not enough to get it working):
>
> http://(anything).(com|net|org|info)?rid=[0-9]{1,5}
>
> ???
>
> Regards
>
> /Brian
>
Hi Brian,
I think this should work, but I'm not sure that ?rid=xxxx is a good spam
sign.
uri BI_U_RIDNUM /\b(?:com|net|org|info|biz)\?rid=[0-9]{1,5}/i
describe BI_U_RIDNUM Message contains URL that Brian wants to catch
score BI_U_RIDNUM 0.001
Hope I didn't mess that up and watch out for line wraps....
-matt
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
