On Tue, 1 Jun 2004, Charles Gregory wrote:
> On Tue, 1 Jun 2004, David B Funk wrote:
> > > > >uri LOC_DIETSITE /[0-9]{3,6}diet\.biz/i
> > If the message was Quoted-Printable encoded with a bastardized variety
> > of QP encoding that uses lower-case HEX characters....
> > So you need to write two versions of that regex, one for
> > 'diet\.biz' and one for 'diet=2ebiz'
>
> I've created a rule to look for
> /^(?:http://)*[^\/]*=/
> ... which should catch any use of '='. From there I'll develop some rules.
>
I forgot to mention, grab the '71_sare_redirect_VARIETY' ruleset from
the rules emporium, it will also detect those. Note that you'll have
to grab the correct variety (pre-v3.0 or post-v3.0).
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
