On Tue, 2010-10-26 at 10:37 -0700, John Hardin wrote: > On Tue, 26 Oct 2010, Karsten Brckelmann wrote: > > > On Tue, 2010-10-26 at 10:53 +0200, Raymond Dijkxhoorn wrote: > >> For your question, why dont you regexp it? > >> > >> uri url_1 /www.domain(1|2|3|4).com/ > > > > The other technique you can use are meta rules > > > > uri __MY_BL_001 /example.(com|net)/ > > uri __MY_BL_002 /example.org/ > > > > meta MY_BL __MY_BL_001 || __MY_BL_002 > > score MY_BL 10.0 > > The OP wasn't clear whether he wanted ten points _per URI hit_. If that's > the case, the regex alternatives and meta solutions aren't appropriate and > there's no way to avoid one score line per URI rule. > ????? What about 'tflags multiple' as in:
uri RULE /(example.(com|net)|example.org|...)/ tflags RULE multiple score RULE 10 The only (minor) drawback I've found is that the list of firing rules can filled with RULE, RULE, RULE,.... by the type of spam that contains nothing but tens of lines pushing variations on a theme such as: Buy FAMOUS SHOE basketMax Buy FAMOUS SHOE basketSuper Buy FAMOUS SHOE basketWimp Buy FAMOUS SHOE runningMax .... Martin
