Why are you bothering with that? It seems unnecessarily complex.
Here's my amended rule:
/\bwww\s?\W?\s?\w{3,6}\d{2,6}s?\W?\s?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
Best regards,
Jeremy Morton (Jez)
John Hardin wrote:
On Fri, 26 Jun 2009, Pawe�~B T�~Ycza wrote:
Dnia 2009-06-23, wto o godzinie 09:39 +0200, Paweł Tęcza pisze:
body OBFU_URI_WWDD_2
/\bwww\s(?:\W\s)?\w{3,6}\d{2,6}\s(?:\W\s)?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
The spammers strike in weekend again. Unfortunately the rule above
doesn't work for the latest incarnation of that spam, it means "www.
pill22. com."
{sung to the tune of Peter Gabriel's "Kiss That Frog"} Whack that mole!
/\bwww(?:\s|\s\W|\W\s)\w{3,6}\d{2,6}(?:\s|s\W|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
