STOPATFIRSTHIT	

#Combination HTTP and URL Encoded /*H:	
	
BODY	0	PCRE	(?i:[%/][2%\?\*][23f%][46af\*%\?][382ha%]([46af]|)([8h]|))	

BODY	0	CONTAINS	/%2a%68
BODY	0	CONTAINS	%2f*%68
BODY	0	CONTAINS	%2f%2ah
BODY	0	CONTAINS	%2f*h
BODY	0	CONTAINS	/*%68
BODY	0	CONTAINS	/%2ah
BODY	0	CONTAINS	/*%68
BODY	0	CONTAINS	/%2ah
BODY	0	CONTAINS	/*%68
BODY	0	CONTAINS	%2f*h
BODY	0	CONTAINS	/%2ah
BODY	0	CONTAINS	%2f*h
BODY	0	CONTAINS	/%3f%68
BODY	0	CONTAINS	%2f?%68
BODY	0	CONTAINS	%2f%3fh
BODY	0	CONTAINS	%2f?h
BODY	0	CONTAINS	/?%68
BODY	0	CONTAINS	/%3fh
BODY	0	CONTAINS	/?%68
BODY	0	CONTAINS	/%3fh
BODY	0	CONTAINS	/?%68
BODY	0	CONTAINS	%2f?h
BODY	0	CONTAINS	/%3fh
BODY	0	CONTAINS	%2f?h
BODY	0	CONTAINS	/%2a%48
BODY	0	CONTAINS	%2f*%48
BODY	0	CONTAINS	%2f%2aH
BODY	0	CONTAINS	/*%48
BODY	0	CONTAINS	/%2aH
BODY	0	CONTAINS	/*%48
BODY	0	CONTAINS	%2f*H
BODY	0	CONTAINS	/%3f%48
BODY	0	CONTAINS	%2f?%48
BODY	0	CONTAINS	%2f%3fH
BODY	0	CONTAINS	/?%48
BODY	0	CONTAINS	/%3fH
BODY	0	CONTAINS	/?%48
BODY	0	CONTAINS	%2f?H

#GENERIC
BODY	END	NOTCONTAINS	.yahoo.com
HEADERS	END	CONTAINS	.yahoo.com with 
REVDNS	END	CONTAINS	.yahoo.

#HTTP Encoded /*h:
BODY	0	CONTAINS	/*h
BODY	0	CONTAINS	/*h
BODY	0	CONTAINS	/*h
BODY	0	CONTAINS	/*h
BODY	0	CONTAINS	/*h
BODY	0	CONTAINS	/*h
BODY	0	CONTAINS	/*h
BODY	0	CONTAINS	/?h
BODY	0	CONTAINS	/?h
BODY	0	CONTAINS	/?h
BODY	0	CONTAINS	/?h
BODY	0	CONTAINS	/?h
BODY	0	CONTAINS	/?h
BODY	0	CONTAINS	/?h
BODY	0	CONTAINS	/*H
BODY	0	CONTAINS	/*H
BODY	0	CONTAINS	/*H
BODY	0	CONTAINS	/*H
BODY	0	CONTAINS	/?H
BODY	0	CONTAINS	/?H
BODY	0	CONTAINS	/?H
BODY	0	CONTAINS	/?H

#Primary Tests:
BODY	0	CONTAINS	/*http:/
BODY	0	CONTAINS	/?http:/
BODY	0	CONTAINS	/**http:/
BODY	0	CONTAINS	/*-http:/

#URL Encoded /*h:
BODY	0	CONTAINS	%2f%2a%68
BODY	0	CONTAINS	/%2a%68
BODY	0	CONTAINS	%2f*%68
BODY	0	CONTAINS	%2f%2ah
BODY	0	CONTAINS	/*%68
BODY	0	CONTAINS	%2f*h
BODY	0	CONTAINS	/%2ah
BODY	0	CONTAINS	%2f%3f%68
BODY	0	CONTAINS	/%3f%68
BODY	0	CONTAINS	%2f?%68
BODY	0	CONTAINS	%2f%3fh
BODY	0	CONTAINS	/?%68
BODY	0	CONTAINS	%2f?h
BODY	0	CONTAINS	/%3fh
BODY	0	CONTAINS	%2f%2a%48
BODY	0	CONTAINS	/%2a%48
BODY	0	CONTAINS	%2f*%48
BODY	0	CONTAINS	/*%48
BODY	0	CONTAINS	%2f%3f%48
BODY	0	CONTAINS	/%3f%48
BODY	0	CONTAINS	%2f?%48
BODY	0	CONTAINS	/?%48

#Yahoo redirection link.
BODY	END	CONTAINS	message/rfc822
BODY	END	CONTAINS	original message
BODY	END	CONTAINS	forwarded message
BODY	END	CONTAINS	wrote in message
BODY	END	CONTAINS	wrote:
BODY	END	CONTAINS	received: from 
BODY	END	CONTAINS	) with ESMTP
BODY	END	CONTAINS	) with SMTP
HEADERS	END	CONTAINS	in-reply-to:
SUBJECT	END	CONTAINS	fw:
SUBJECT	END	CONTAINS	fwd:
SUBJECT	END	CONTAINS	(fwd)

#Yahoo's redirection.
BODY	END	CONTAINS	Do you Yahoo!?
BODY	END	CONTAINS	http://pa.yahoo.com/*http://
BODY	END	CONTAINS	http://us.rd.yahoo.com/dailynews/reuters
BODY	END	CONTAINS	http://us.rd.yahoo.com/maps/
BODY	END	CONTAINS	/*-http://maps.yahoo.com
