Bowie Bailey wrote: > > JPP100 wrote: >> >> 1. English URL >> 2. Double words separated with a '-' >> 3. Rarely a 'www' at the front - usually 4 or more random letters >> 4. Always (for now) 4 numbers at the end >> Example: >> http://llhti.tour-traveled.com/4651/ >> >> So my rule: >> # hotmail drug spam >> uri MY_HOTMAIL_SPAM >> m{https?://{1,30}\.{1,30}\.(com|ru|cn)/[0-9][0-9][0-9][0-9]/i} >> describe MY_HOTMAIL_SPAM Druggy hotmail.com links >> score MY_HOTMAIL_SPAM 5.0 >> > > Your rule specifies 1-30 slashes followed by 1-30 periods. Try this one > instead: > > m{https?://[a-z]{1,30}\.[a-z]{1,30}-[a-z]{1,30}\.(com|ru|cn)/\d{4}/}i > > (I assume you intended the 'i' at the end to be a case-insensitive > setting and not part of the regex) > > -- > Bowie > >
Thank you! And yes, the 'i' was meant as 'case insensitive'. I changed the rule and will see how it goes. I am an old school Procmail person and sometimes these mixed rules drive me nuts and are not intuitive (yet). I will get there. I am surprised that some of the other SPAM based systems have not caught these yet, as obvious as they seem to be (ie. ClamAV SPAM lists, etc etc). Will let you know. Thanks again. JPP -- View this message in context: http://old.nabble.com/A-little-help-with-a-local.cf-rule...-please%21-tp26970283p26970489.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
