Also, checking /ebay\.com/ will trigger on anything that combines a word ending in e with "bay" (I saw this on a log entry about a message from someplace called azurebay.com, although I suspect that was spam as well.) You should probably check on /\bebay.com\b/i instead.
That will only match on " ebay.com " though, right? I'm interested in any occurence of ebay.com, embedded in URLs as well (i.e. http://blah.ebay.com/fasel/)
\b matches any word boundary (where one side is alphanumeric and the other side isn't - or isn't there), so /\bebay\.com/ will match "ebay.com" or "www.ebay.com" or "othersite/ebay.com"
Kelson Vibber
SpeedGate Communications <www.speed.net>
