[EMAIL PROTECTED] writes:
> Author: felicity
> Date: Wed Jan 9 19:40:56 2008
> New Revision: 610660
>
> URL: http://svn.apache.org/viewvc?rev=610660&view=rev
> Log:
> look for lucky google searches in a URI
damn, we now have *three* of them ;)
rulesrc/sandbox/dos/70_other.cf:uri DOS_GOOGLE_LUCKY_REDIRECT
m{^http://[^/]\.google\.[^/]/search?(?:.*&|&?)btnI=?}
rulesrc/sandbox/jm/20_basic.cf:uri JM_I_FEEL_LUCKY
/(?:\&|\?)btnI=ec(?:$|\&)/
http://ruleqa.spamassassin.org/?q=/LUCKY notes:
0.00000 0.0129 0.0000 1.000 0.55 0.00 T_JM_I_FEEL_LUCKY
We should probably force "tflags publish" despite the low hitrate
since as a poster noted, it's 100% spamsign.
interestingly, DOS_GOOGLE_LUCKY_REDIRECT doesn't seem to have a single hit
in any of the mass-check logs or on ruleQA; I suspect the unprotected '&'
may be causing trouble for that rule. :(
--j.
