On Thu, 2 Jul 2009, Michelle Konzack wrote:
body AE_MEDS35
/\bwww(?:\s\W?\s?|\W\s)\w{3,6}\d{2,6}(?:\s\W?\s?|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
doea not work on the following mail:
----8<------------------------------------------------------------------
Doo You Maake These 4 Mistakes in sex? www. gen65. net. Police: Dancers Shot
With Paintbrall Guns In Boynton Baech Strip Club
----8<------------------------------------------------------------------
Works here:
[6237] dbg: rules: ran body rule MEDS ======> got hit: "www. gen65. net"
The rule name in my test harness is different but I verified that the RE
is the same.
Can you post the original raw message to a pastebin, please?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Microsoft is not a standards body.
-----------------------------------------------------------------------
2 days until the 233rd anniversary of the Declaration of Independence
