|-----Original Message----- |From: Duncan Hill [mailto:[EMAIL PROTECTED] |Sent: 05 March 2005 15:02 |To: users@spamassassin.apache.org |Subject: Re: [SPAM-TAG] SURBL missing this spam | |On Saturday 05 March 2005 14:49, martin smith wrote: |> |uri SpoofPort_URL /.*\....:.*|.*\...:.*/ score SpoofPort_URL 1 |> |> Ok MK2 that one could FP on genuine URLs with a port specified |> |> uri SpoofPort_URL /.*\....:.*|.*\...:.*/ score SpoofPort_URL 1 uri |> OkPort_URL |> /.*\....:....|.*\...:...../|/.*\....:....\/.*|.*\...:.....\/.*/ |> score OkPort_URL -1 | |Hmm.. the variant I came up with doesn't use the uri tag, instead: |body SURBL_DODGE /http(s)?|ftp:\/\/.*:\// |score SURBL_DODGE 5 | |The only problem being that it can score on a url like |http://some.good.site/fred:/ | |Why someone would have a : in the path or query, I don't know, |but it's a posssibilty.
Unfortunately that will FP if u have any text after the URL with :/ E.g Take a look at http://some.good.site you never know:/ |
