[SURBL-Discuss] New redirector crap

[Daryl C. W. O'Shea]

Raymond Dijkxhoorn wrote:
> Hi!
> 
> There is a new redirector thats been abused heavilly by spammers:
> 
> <a 
> href=http://redir.internet.com/rss/click/rsv%2e%72%65co%72c%6fmp%61%6ei%2ec%6f%6D/?maybetter 
> target=_blank><font size=5 color=1C1CFF><u><b>C1icck here
> to 0rder interest</font></font></b></u></a><br><br>
> 
> Its pointing towards a pillspammer.
> 
> Meanwhile, while we are contacting internet.com you could add this 
> ruleset to your SA configs:
> 
> uri PROLO_REDIR_INET_CHECK1 /^http:\/\/redir\.internet\.com\/rss\//
> score PROLO_REDIR_INET_CHECK1  8.0
> describe PROLO_REDIR_INET_CHECK1 PROLO_REDIR-INET CHECK, Body
> 
> Bye,
> Raymond.
Like some other redirectors, this one doesn't appear to care what the 
two subdirectories are called, so you may be better off with something like:

/^http:\/\/redir.internet.com\/.+?\/.+?\/.*$/i

or if you are using a pre-release version of SA 3.1:

redirector_pattern      /^http:\/\/redir.internet.com\/.+?\/.+?\/(.*)$/i


Daryl