Hi,
> I am getting rather tired from messages spamming porn-portals. They typically
> originate from hotmail.com, and advertise a porn-portal based on
> google.com/groups, google.com/reader, groups.yahoo.com, pipes.yahoo.com,
> spaces.live.com, docs.google.com, sites.google.com and livejournal.com.
This was posted by Martin a week or so ago in response to a similar
question by me:
This should catch your set and more:
uri LOC_YAHOO /^http:.{1,40}\.yahoo[.,]com/i
score LOC_YAHOO 0 1.5 0 1.5
describe LOC_YAHOO Contains *.yahoo.com uri
Or, if you want to be more specific, try this:
uri LOC_YAHOO /^http:\/\/(groups|profile|personals)\.yahoo[.,]com/i
score LOC_YAHOO 0 1.5 0 1.5
describe LOC_YAHOO Contains yahoo.com groups/profile/personals uri
Does this help?
Best regards,
Alex
