On Tue, 15 Dec 2009, Chris Santerre wrote:
A few months back there was a wave of spam coming from abused Polish .pl
TLD.
It seems iContact uses random generated directories in thier tracking URLs
that contain a period. Yup... you guessed it... incontact/a.pl/xxxxxxxx
means it hits the rule.
The wide variation of possible page names, plus cgi parameters obliges us
to 'tighten' our URI regexes....
uri LOC_RU_URI /^(http:\/\/|mailto:)?[^\/\?]+\.ru/
This will only look for '.ru' before any slash or question mark that would
delineate the end of the domain name portion of the URI.
- C
