It is tough to remember everything SA looks for. Does 2.60 have something like this? Comments?
rawbody MY_TROJANED_HOST /http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{2,4}\// describe MY_TROJANED_HOST Possible Trojaned box used for spam hosting score MY_TROJANED_HOST 0.01 # For testing
why not do this as a uri rule, instead of a rawbody?
uri MY_TROJANED_HOST /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{2,4}\//
------------------------------------------------------- This SF.net email is sponsored by OSDN developer relations Here's your chance to show off your extensive product knowledge We want to know what you know. Tell us and you have a chance to win $100 http://www.zoomerang.com/survey.zgi?HRPT1X3RYQNC5V4MLNSV3E54 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
