On Sun, Jun 28, 2009 at 01:08:45PM +0930, Cory Hawkless wrote: > I agree, wouldn't it be easier to uniformly feed all of these type of URL's > though the already existing SA filters. As Jason suggested maybe by > collapsing whitespaces? > > Sounds like the obvious solution to me? Any problems with this? If not how > can it be done?
You don't see a problem? What about all of these and others? example,com example dot com example & com exampleCOM example-com example`com Pretty soon SA is parsing dozens of "domains" from any given message and uribls collapse from the load. ;-) Not to mention all the FP possibilities. Maybe there could be some very specific rules to extend the url search. Something like "/www \w+ com/i + s/ /./g". But someone would have to distribute these rule updates. How would that be done when no one is even distributing the simple rules posted here to catch this current spam run? Hopefully some day (after SA 3.3 is released?) we see more frequent sa-updates, especially if more people get SVN access and rules get checked in nightly or faster.
