Raymond Dijkxhoorn wrote:
Hi!
There is a new redirector thats been abused heavilly by spammers:
<a href=http://redir.internet.com/rss/click/rsv%2e%72%65co%72c%6fmp%61%6ei%2ec%6f%6D/?maybetter target=_blank><font size=5 color=1C1CFF><u><b>C1icck here to 0rder interest</font></font></b></u></a><br><br>
Its pointing towards a pillspammer.
Meanwhile, while we are contacting internet.com you could add this ruleset to your SA configs:
uri PROLO_REDIR_INET_CHECK1 /^http://redir.internet.com/rss// score PROLO_REDIR_INET_CHECK1 8.0 describe PROLO_REDIR_INET_CHECK1 PROLO_REDIR-INET CHECK, Body
Bye, Raymond.
Like some other redirectors, this one doesn't appear to care what the two subdirectories are called, so you may be better off with something like:
/^http://redir.internet.com/.+?/.+?/.*$/i
or if you are using a pre-release version of SA 3.1:
redirector_pattern /^http://redir.internet.com/.+?/.+?/(.*)$/i
Daryl