On Thu, 1 Oct 2009, Ned Slider wrote:
John Hardin wrote:
On Thu, 1 Oct 2009, Warren Togami wrote:
> uri T_CN_URL /[^\/]+\.cn(?:$|\/|\?)/i
> describe T_CN_URL Contains a URL in the .cn domain
>
> uri T_CN_8_URL /[\/.]+\w{8}\.cn(?:$|\/|\?)/i
> describe T_CN_8_URL Contains a URL in the .cn domain of exactly 8
> characters long
>
> http://ruleqa.spamassassin.org/20090930-r820211-n/T_CN_URL/detail
> Last night's masscheck. 63243 out of 124241 spam hits T_CN_URL, nearly
> 51%.
>
> 7263 T_CN_URL hits in 15517 spam corpus
> 7200 T_CN_8_URL hits in 15517 spam corpus
>
> Does this make any sense? This is funny. Could someone add this rule
> to the sandbox? I'm just curious.
I note that neither is anchored at the beginning of the URI, so they may
be hitting on .cn embedded somewhere within the path part.
That doesn't explain 51%, though.
I run my own custom .cn tld URI rule, and whilst it's right down in
percentage terms atm, in the past it has certainly hit on around 50% plus of
all spam containing a URI. So depending on the corpus, I'm not surprised by
the 51%.
uri LOCAL_URI_CN m{https?://.{1,40}\.cn\b}
describe LOCAL_URI_CN contains link to Chinese tld
Yours may still hit .cn in the path part. May I suggest:
m;^https?://[^/?]+\.cn\b;
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
If "healthcare is a Right" means that the government is obligated
to provide the people with hospitals, physicians, treatments and
medications at low or no cost, then the right to free speech means
the government is obligated to provide the people with printing
presses and public address systems, the right to freedom of
religion means the government is obligated to build churches for the
people, and the right to keep and bear arms means the government is
obligated to provide the people with guns, all at low or no cost.
-----------------------------------------------------------------------
Approximately 9052800 firearms legally purchased in the U.S. this year
