On Saturday 05 March 2005 14:49, martin smith wrote: > |uri SpoofPort_URL /.*\....:.*|.*\...:.*/ score SpoofPort_URL 1 > > Ok MK2 that one could FP on genuine URLs with a port specified > > uri SpoofPort_URL /.*\....:.*|.*\...:.*/ > score SpoofPort_URL 1 > uri OkPort_URL > /.*\....:....|.*\...:...../|/.*\....:....\/.*|.*\...:.....\/.*/ > score OkPort_URL -1
Hmm.. the variant I came up with doesn't use the uri tag, instead: body SURBL_DODGE /http(s)?|ftp:\/\/.*:\// score SURBL_DODGE 5 The only problem being that it can score on a url like http://some.good.site/fred:/ Why someone would have a : in the path or query, I don't know, but it's a posssibilty.
