Raymond Dijkxhoorn wrote:

Hi!

There is a new redirector thats been abused heavilly by spammers:

<a href=http://redir.internet.com/rss/click/rsv%2e%72%65co%72c%6fmp%61%6ei%2ec%6f%6D/?maybetter target=_blank><font size=5 color=1C1CFF><u><b>C1icck here to 0rder interest</font></font></b></u></a><br><br>

Its pointing towards a pillspammer.

Meanwhile, while we are contacting internet.com you could add this ruleset to your SA configs:

uri PROLO_REDIR_INET_CHECK1 /^http://redir.internet.com/rss// score PROLO_REDIR_INET_CHECK1 8.0 describe PROLO_REDIR_INET_CHECK1 PROLO_REDIR-INET CHECK, Body

Bye, Raymond.

Like some other redirectors, this one doesn't appear to care what the two subdirectories are called, so you may be better off with something like:

/^http://redir.internet.com/.+?/.+?/.*$/i

or if you are using a pre-release version of SA 3.1:

redirector_pattern /^http://redir.internet.com/.+?/.+?/(.*)$/i

Daryl