It was floating around the list a couple weeks ago. Someone noticed that a
lot of spams have a variant of ?AFF_ID= in the url for the spam site.
Likely this has been collected into one of the groups of spam rules out
there, but I don't know which one. I just have it loose in my user_conf
file.
Loren
----- Original Message -----
From: "Robert Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, February 24, 2004 6:20 AM
Subject: Re: new kind of spam?
> Loren Wilton wrote:
> > Sure enough, they are slipping through. Two of them though you can
catch
> > with the AFF_ID rule:
> >
> > uri AFF_ID /AFF\w+ID=/i
> > describe AFF_ID URL contains AFF_ID=
> > score AFF_ID 3
>
> where does this test come from?
