Hi I've been attempting to get the split line URL rule working - this one..
rawbody __LW_URI_CR1 /href=\"[^"]*\r[^\n]/is full __LW_URI_CR2 /href=\"[^"]*\r[^\n]/is meta LW_URI_CR __LW_URI_CR1 || __LW_URI_CR2 score LW_URI_CR 2 describe LW_URI_CR unescaped cr in uri I get quite a few spams that have this kind of URL within them.. <A href="h ttp:/ /bnonfotphbjf.org&leuhpma0tq75u076lha%2Eul liful l8%2Ecom/"> Which dont seem to trigger the above rule. Any ideas? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. **********************************************************************
