> -----Original Message----- > From: sckot [mailto:[EMAIL PROTECTED] > Sent: Wednesday, January 21, 2004 3:45 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Multi-line matching workarounds? > > > Some archive searching has revealed that multi-line > matching isn't > available yet. Is there another way to rework this rule that I'm > missing, using meta rules perhaps? It would single-handedly > get a lot of > spam that I get, which is consistantly of the form of three "ambiguous > product pitch:\nurl\n\n"s. My email address appears in the third URL, > and the first two are mostly numeric. > > rawbody L_3_Part_Pitch_Spam > /.*:\nhttp:\/\/[a-z]{2}[0-9]\.\w{1,20}\.com\/([0-9]*\/)*[a-z]{1,20}\. > htm(l)?\n\n.*:\nhttp:\/\/[a-z]{2}[0-9]\.\w{1,20}\.com\/([0-9]* > \/)*[a-z] > {1,20}\.htm(l)?\n\n.*:\nhttp:\/\/[a-z]{2}[0-9]\.\w{1,20}\.com\ > /([EMAIL PROTECTED] > *\/)*\/.htm(l)?/ > describe L_3_Part_Pitch_Spam Mail has six lines, three are URLS > > Thanks, > sckot Vokes >
I tried similar things, but the \n never worked right. I think rawbody doesn't see them. The only way to do this is with an EVAL function. Not a bad idea to look at the overall length of email and see what percentage of it is html link. SA has a rule like this, but might need some tweaking for smaller emails????? --Chris (Already having a day from hell.) Santerre ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
