geocities spam, why isn't it caught
Denis.Beauchemin at USHERBROOKE.CA
Tue Aug 23 13:51:55 IST 2005
[ The following text is in the "ISO-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]
Remco Barendse wrote:
> I don't understand the format fully but have now added this to prolo.cf:
> uri PROLO_PUBWEB_GEO_CHECK /^http:\/\/*\.geocities\.com\//
> score PROLO_PUBWEB_GEO_CHECK 15.0
> describe PROLO_PUBWEB_GEO_CHECK PROLO_PUBWEB_GEO_CHECK, Body
> I hope this will trap any e-mail with geocities domain in it?
You made a small error in the regex: /^http:\/\/*\.geocities\.com\//
will match http://.geocities.com/ or http:/.geocities.com/ or
What you want is: /^http:\/\/.*\.geocities\.com\// will match
http://anything.geocities.com/ or http://.geocities.com/
If you don't want the dot in front of geocities, use:
/^http:\/\/.*\bgeocities\.com\// will match http://geocities.com/ or
http://anything-geocities.com/ but not http://nogeocities.com/
°v° Denis Beauchemin, analyste
/(_)\ Université de Sherbrooke, S.T.I.
^ ^ T: 819.821.8000x2252 F: 819.821.8045
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner