[SURBL-Discuss] More spams with Zdnet redirector

Daryl C. W. O'Shea spamassassin at dostech.ca
Sat Apr 9 11:52:05 CEST 2005


Raymond Dijkxhoorn wrote:
> Hi!
> 
>>>>> full PROLO_REDIR_ZDNET_CHECK_1 /http:\/\/.*chkpt.zdnet.com\/chkpt/
>>>>> score PROLO_REDIR_ZDNET_CHECK_1  8.0
>>>>> describe PROLO_REDIR_ZDNET_CHECK_1 PROLO_REDIR-ZDNET CHECK_1_2_3, Body
>
>> Your rule above, using uri instead of full, works under both 3.0 and 
>> 3.1 (and probably older versions).

> So how would it look like? I have no problem replacing it with a less 
> CPU exhausting model ;)

The exact same regex above would work as a uri test.  Though, you might 
want to use:

uri PROLO_REDIR_ZDNET_CHECK_1 /^http:\/\/.*chkpt\.zdnet\.com\/chkpt/

...and to more closely match the zdnet redirector...

uri PROLO_REDIR_ZDNET_CHECK1 /^http:\/\/chkpt\.zdnet\.com\/chkpt\//


Daryl



More information about the Discuss mailing list