On 8/28/2006 3:53 AM, Whisky wrote:
There's a lot of spam lately, which contains urls with subdirectories, such
as http://spamdomain.org/gal/ms/.
I have thus set up the following rule:
body BODY_ADDS_22 /(\/za\/|\/wd\/|\/iu\/|\/xi\/|\/gal\|\/tx\/|\/nu\/)/i
However, when I send a testmail that conatins the string "/gal" the rule is
not triggered. What am I doing wrong here?
The regex doesn't match the sample URI above since you're missing a
slash in the regex. You're looking for "/gal|/tx/" instead of "/gal/".
You'd be better off with the regex used in this rule:
body BODY_ADDS_22 m{/(?:za|wd|iu|xi|gal|tx|nu)/}i
and even better off using a URI rule:
uri BODY_ADDS_24 m{/(?:za|wd|iu|xi|gal|tx|nu)/}i
Daryl
