John Wilcock wrote:
Matthew Wilson wrote: uri local_GOOGLE_LUCKY /(?:\bgoogle\b)*&btnI=/i
Can this be right? To me it looks like it matches things like
&btnI= google&btnI= googlegoogle&btnI= googlegooglegoogle&btnI=
Just a missing . maybe? /(?:\bgoogle\b).*&btnI=/i ^ here
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"
Matthew.van.Eerde@hbinc.com wrote:
Just a missing . maybe? /(?:\bgoogle\b).*&btnI=/i ^ here
Yes, of course, or better still .+ Thanks for pointing that out.
uri local_GOOGLE_LUCKY /(?:\bgoogle\b).+(?:&btnI=)/i
This doesn't seem to be a very common tactic yet anyway - the rule hasn't hit anything at all, spam or ham, (apart from a test message of my own) since I added it yesterday.
John.
-
John Wilcock -
Matthew.van.Eerde＠hbinc.com