On Thu, 2 Jul 2009, Michelle Konzack wrote:
> body AE_MEDS35 /\bwww(?:\s\W?\s?|\W\s)\w{3,6}\d{2,6}(?:\s\W?\s?|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
>
> doea not work on the following mail:
>
> ----8<------------------------------------------------------------------
>
> Doo You Maake These 4 Mistakes in sex? www. gen65. net. Police: Dancers Shot With Paintbrall Guns In Boynton Baech Strip Club
>
> ----8<------------------------------------------------------------------
Works here:
[6237] dbg: rules: ran body rule MEDS ======> got hit: "www. gen65. net"
The rule name in my test harness is different but I verified that the RE
is the same.
Can you post the original raw message to a pastebin, please?
--
John Hardin KA7OHZ
http://www.impsec.org/~jhardin/ jhardin@... FALaholic #11174 pgpk -a
jhardin@...
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Microsoft is not a standards body.
-----------------------------------------------------------------------
2 days until the 233rd anniversary of the Declaration of Independence
