google group spam

[JC Putter <jc...@centreweb.co.za>]

    hi i am using this rule to catch spam with a google group link,

uri      __GOOGLEGROUPS_15  m'http://[^.]{15}\.googlegroups\.com'i
meta     NN_GOOGLEGROUPS_15 __GOOGLEGROUPS_15 && __GOOGLEGROUPS_NUM
describe NN_GOOGLEGROUPS_15  Contains a suspicious googlegroups URI.
score    NN_GOOGLEGROUPS_15 2

but now i am getting a new type of one which the rules doesnt catch "http://groups.google.com/group/

can someone please help me write a rule for this link?


__________ Information from ESET NOD32 Antivirus, version of virus signature database 3973 (20090329) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: google group spam

[LuKreme <kr...@kreme.com>]

On 29-Mar-2009, at 16:42, JC Putter wrote:
> uri      __GOOGLEGROUPS_15  m'http://[^.]{15}\.googlegroups\.com'i
> meta     NN_GOOGLEGROUPS_15 __GOOGLEGROUPS_15 && __GOOGLEGROUPS_NUM
> describe NN_GOOGLEGROUPS_15  Contains a suspicious googlegroups URI.
> score    NN_GOOGLEGROUPS_15 2
>
> but now i am getting a new type of one which the rules doesnt catch "http://groups.google.com/group/
>
> can someone please help me write a rule for this link?

uri      __GOOGLEGROUPS_15  m'http://groups\.google\.com\/group\/'i

I dunno what the {15} was meant to accomplish (why 15 characters  
specifically?  14 is not suspicious? 37 is not suspicious either?),  
but that will match any google groups link in the form you posted.


-- 
The Piper's calling you to join him