Jonathan Nichols wrote:
uri GEOCITIES /uk.geocities.com/i
describe GEOCITIES High amounts of spam from Geocities.
score GEOCITIES 4.0
... spamassassin --lint came out ok.
Will this work, or have I accomplished something that I wasn't actually
trying to do? ;)
A better approach:
uri GEOCITIES /\buk\.geocities\.com\b/i
A "." by itself will match any single character, so ukrgeocities2com
would match. "\." matches a period specifically. Not that this is
likely to show up in this case, but it's worth remembering for rule
writing in general.
Also, "\b" matches a word boundary. That prevents it from matching
something like "geocities.commander" -- again, not a likely problem in
this case, but useful for future reference.
You could even get very specific, with this:
uri GEOCITIES /^http:\/\/uk\.geocities\.com\b/i
The "^" anchors the match to the beginning of the URI, and the "\/"
indicates that the forward slash is part of the match, not the closing
delimiter.
Of course, if you want to match *any* Geocities URL (which I think is a
bit much for a 4-point score), you'd want something like this:
uri GEOCITIES /\.geocities\.com\b/i
or if you want to make sure it matches the domain name,
uri GEOCITIES /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
