The beginning of the rule has where to search the email (eg. BODY,
HEADERS, ANYWHERE, SUBJECT) in this case BODY is the body of the email
just as you have defined it.
David
On 1/8/2015 9:00 AM, Martin Schaible wrote:
Hello
I’m looking for rule, to detect a web address from certains TLD‘s in
the body. The body contains the URL only.
body 10 pcre (?i:http://.{1.25}\.(com|ru))
The missing rule is, how to say „This is the only content in the
body“. Maybe i need to know how the detect the beginning and end of
the body.
Many thanks
Freundliche Grüsse
--------------------------------------------------------------------------------------
*netfusion GmbH* | Martin Schaible
Mittelfeldstrasse 27 | CH-8700 Küsnacht | Switzerland
Tel.: +41 44 391 30 00
E-Mail: [email protected] <mailto:[email protected]>
Internet:www.netfusion.ch <http://www.netfusion.ch/>|
wiki.netfusion.ch <http://wiki.netfusion.ch/>
Portal: portal.netfusion.ch <http://portal.netfusion.ch/>
Wird sind auch auf Facebook präsent: www.facebook.com/NetfusionGmbH
<http://www.facebook.com/NetfusionGmbH>
--------------------------------------------------------------------------------------
nfqrcode150x150
--
David Barker
Mail’s Best Friend
Email : [email protected]
Web : www.mailsbestfriend.com
Office : 866.919.2075
Mobile : 978.518.6461
