On Fri, 2014-08-29 at 12:43 -0600, Philip Prindeville wrote: > On Aug 29, 2014, at 6:45 AM, Kevin A. McGrail <kmcgr...@pccc.com> wrote: > > On 8/29/2014 5:48 AM, emailitis.com wrote:
> > > I have a lot of Spam getting into our mail servers where the common > > > thread is cloudapp You guys realize cloudapp.net is Microsoft Azure, don't you? > > > And the hyperlinks in the emails are http://expert.cloudapp.net/..... > > > > > > Please could you advise on how I can block by the information on > > > the maillog on that, or using a rule which checks the URL to include > > > the above thread? SA does not block. > > There is a new feature in trunk that I believe will help you easily > > called URILocalBL.pm > That should do it. > > There’s a configuration example in the bug, and POD documentation in > the plugin, but in this particular case you’d do something like: > > uri_block_cidr L_BLOCK_CLOUDAPP 191.237.208.246 > body L_BLOCK_CLOUDAPP eval:check_uri_local_bl() That seem an overly complicated variant of a simple uri regex rule. And it really depends on the IP to match a URI? And manual looking it up? uri URI_EXPERT_CLOUDAPP m~^https?://expert\.cloudapp\.net$~ > describe L_BLOCK_CLOUDAPP Block URI’s pointing to expert.cloudapp.net > score L_BLOCK_CLOUDAPP 5.0 SA does not block. *sigh* -- char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
