in context:
http://old.nabble.com/A-little-help-with-a-local.cf-rule...-please%21-tp26970283p26970283.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
JPP100 wrote:
1. English URL
2. Double words separated with a '-'
3. Rarely a 'www' at the front - usually 4 or more random letters
4. Always (for now) 4 numbers at the end
Example:
http://llhti.tour-traveled.com/4651/
So my rule:
# hotmail drug spam
uri MY_HOTMAIL_SPAM
So my rule:
# hotmail drug spam
uri MY_HOTMAIL_SPAM
m{https?://{1,30}\.{1,30}\.(com|ru|cn)/[0-9][0-9][0-9][0-9]/i}
describe MY_HOTMAIL_SPAM Druggy hotmail.com links
score MY_HOTMAIL_SPAM 5.0
And running emails through it using -D, it does not hit it as far as
I
this message in context:
http://old.nabble.com/A-little-help-with-a-local.cf-rule...-please%21-tp26970283p26970489.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
On Wed, 30 Dec 2009, Bowie Bailey wrote:
m{https?://[a-z]{1,30}\.[a-z]{1,30}-[a-z]{1,30}\.(com|ru|cn)/\d{4}/}i
You might want to reconsider using {} as RE delimiters if the RE itself
contains {} elements. If it works, fine, but it's very visually confusing.
--
John Hardin KA7OHZ
