[SURBL-Discuss] google is open redirector

John Wilcock john at tradoc.fr
Thu Mar 24 08:10:09 CET 2005

Matthew.van.Eerde at hbinc.com wrote:
> Just a missing . maybe?
> /(?:\bgoogle\b).*&btnI=/i
>                ^ here

Yes, of course, or better still .+
Thanks for pointing that out.

uri     local_GOOGLE_LUCKY    /(?:\bgoogle\b).+(?:&btnI=)/i

This doesn't seem to be a very common tactic yet anyway - the rule 
hasn't hit anything at all, spam or ham, (apart from a test message of 
my own) since I added it yesterday.


-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

More information about the Discuss mailing list