Body SA rule

[Derek Winkler]

Here's one I use...

rawbody LOCAL_CNTNTFRM_vresp    /https?:\/\/.*?\.vresp\.com/i
describe LOCAL_CNTNTFRM_vresp   Has " http://*.vresp.com
<http://*.vresp.com> " in body
score LOCAL_CNTNTFRM_vresp      3

In the reg exp /s and .s must be preceded by \, makes it confusing. The ?
makes the s optional so http or https will work. The i after the final /
means case insensitive.

Your reg exp would be "/http:\/\/www\.xx-yyyyy\.com/" off the top of my head
anyways.

-----Original Message-----
From: Stephe Campbell [mailto:campbell at cnpapers.com]
Sent: Tuesday, March 18, 2003 10:19 AM
To: MAILSCANNER at jiscmail.ac.uk
Subject: Body SA rule


This is not a MS problem, but I have yet been able to find anything in the
SA archives and hope that someone using MS has done this before. I'm not
versed in Perl, so I sort of need assistance. The people of this maillist
really seem to be on the ball.

We receive a lot of spam from a particular group. Each mailing is from
various sources, but all have the following line in them(actually a reply
link where I have replaced the real address with x's, y's, etc):


 visit at  <http://www.xx-yyyyy.com/34606zzz.html>
http://www.xx-yyyyy.com/34606zzz.html

I would like to use a body or rawbody (uri or full maybe?) rule to find
"html://www.xx-yyyyy.com" and give it a score in SA by adding it to my
spam.assassin.prefs.conf file but have not yet figured out how to write it.
My Header rules work fine, but all of my attempts at this seem to be all for
nothing.

Any help would be appreciated and sorry for the non-MS stuff.



steve campbell
campbell at cnpapers.com <mailto:campbell at cnpapers.com>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030318/cd703ccc/attachment.html