> -----Original Message-----
> From: Maarten de Boer [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, February 23, 2006 5:06 AM
> To: users@spamassassin.apache.org
> Subject: rule for spam with geocities link, multiline _expression_
>
>
> Hello,
>
> I am receiving, already several weeks, a lot of spam in the following
> form:
> ---------
> \w+,
>
> http://\w\w.geocities.com/\w+\d+
>
> \w+ \w+
> ---------
>
> For example:
>
> ---------
> Beth,
>
> http://au.geocities.com/ethylic40187
>
> Rocco Maldonado
> ---------
>
> Is it possible to write a rule to detect these? I don't know how to
> write a rule the spans multiple lines. Or maybe someone has already
> written this rule?
>
> Kind regards,
>
> maarten
Its in teh SARE specific ruleset already:
http://www.rulesemporium.com/rules/70_sare_specific.cf
Hmmm.... it might be worthwhile to be able to search all the SARE rules for a given phrase. Kind of hard as a lot is just regex code.
Chris Santerre
SysAdmin and SARE/URIBL ninja
http://www.uribl.com
http://www.rulesemporium.com
