geocities spam, why isn't it caught

[Denis Beauchemin]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Remco Barendse wrote:

> I don't understand the format fully but have now added this to prolo.cf:
>
> uri PROLO_PUBWEB_GEO_CHECK /^http:\/\/*\.geocities\.com\//
> score PROLO_PUBWEB_GEO_CHECK  15.0
> describe PROLO_PUBWEB_GEO_CHECK PROLO_PUBWEB_GEO_CHECK, Body
>
> I hope this will trap any e-mail with geocities domain in it?
>
You made a small error in the regex: /^http:\/\/*\.geocities\.com\// 
will match http://.geocities.com/ or http:/.geocities.com/ or 
http://////.geocities.com/

What you want is: /^http:\/\/.*\.geocities\.com\// will match 
http://anything.geocities.com/ or http://.geocities.com/

If you don't want the dot in front of geocities, use: 
/^http:\/\/.*\bgeocities\.com\// will match http://geocities.com/ or 
http://anything-geocities.com/ but not http://nogeocities.com/

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!