Mailing List Archive: SpamAssassin: users

wildcard http match

Index | Next | Previous | View Threaded

thomas.kinghorn at gmail

Jan 30, 2012, 12:40 AM

Post #1 of 3 (290 views)
Permalink

wildcard http match

Good morning list.

Please forgive me my ignorance.
The 2.5 hour drive to work has drained any remaining intelligence.
As such, I cannot seem to figure this one out.

I am receiving alot of spam with the body as follows

<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
<a href=http://hNwXJKlHIH.page.tl"]"http://hNwXJKlHIH.page.tl">iddsw naolsnqjxq hbw z hetwe qjqaskbr bxkjwnfyz.</a>
</body>
</html>

How would I go about matching anything with the domain of .tl (which is East Timor if anyone is interested)

thanks again.
Tom

axb.lists at gmail

Jan 30, 2012, 12:46 AM

Post #2 of 3 (282 views)
Permalink

Re: wildcard http match [In reply to]

On 01/30/2012 09:40 AM, Tom Kinghorn wrote:
> Good morning list.
>
> Please forgive me my ignorance.
> The 2.5 hour drive to work has drained any remaining intelligence.
> As such, I cannot seem to figure this one out.
>
> I am receiving alot of spam with the body as follows
>
> <html>
> <head>
> </head>
> <body bgcolor="#ffffff" text="#000000">
> <a href="http://hNwXJKlHIH.page.tl">iddsw naolsnqjxq hbw z hetwe qjqaskbr
> bxkjwnfyz.</a>
> </body>
> </html>
>
> How would I go about matching anything with the domain of.tl (which is East
> Timor if anyone is interested)

uri URI_PAGE_TL /\w+\.page\.tl/

should do the trick for these spams

in SA 3.4 you will be able to safely blacklist the whole TLD

thomas.kinghorn at gmail

Jan 30, 2012, 12:53 AM

Post #3 of 3 (286 views)
Permalink

Re: wildcard http match [In reply to]

On 30/01/2012 10:46, Axb wrote:
>
> uri URI_PAGE_TL /\w+\.page\.tl/
>
> should do the trick for these spams
>
> in SA 3.4 you will be able to safely blacklist the whole TLD
>

Perfect.!!

Thank you very much.
Much appreciated.

Tom

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads