Body SA rule

Derek Winkler dwinkler at ALGORITHMICS.COM
Tue Mar 18 15:56:41 GMT 2003

I'm not sure whether that is an issue or not.

-----Original Message-----
From: Stephe Campbell [mailto:campbell at]
Sent: Tuesday, March 18, 2003 10:50 AM
Subject: Re: Body SA rule

Mr. Winkler,

Thank you very much. That seemed to work, although I think I may have tried
that same rule you provided. The difference was I used a rule name with a
hyphen instead of underscore. Do you know if that is a real issue? I might
be wrong though on whether I used your regexp prior, I tried so many.

Thanks again

Steve Campbell
campbell at <mailto:campbell at>

----- Original Message -----
From: Derek Winkler <mailto:dwinkler at ALGORITHMICS.COM>
Sent: Tuesday, March 18, 2003 10:30 AM
Subject: Re: Body SA rule

Here's one I use...

rawbody LOCAL_CNTNTFRM_vresp    /https?:\/\/.*?\.vresp\.com/i
describe LOCAL_CNTNTFRM_vresp   Has " http://*
<http://*> " in body
score LOCAL_CNTNTFRM_vresp      3

In the reg exp /s and .s must be preceded by \, makes it confusing. The ?
makes the s optional so http or https will work. The i after the final /
means case insensitive.

Your reg exp would be "/http:\/\/www\.xx-yyyyy\.com/" off the top of my head

-----Original Message-----
From: Stephe Campbell [mailto:campbell at]
Sent: Tuesday, March 18, 2003 10:19 AM
Subject: Body SA rule

This is not a MS problem, but I have yet been able to find anything in the
SA archives and hope that someone using MS has done this before. I'm not
versed in Perl, so I sort of need assistance. The people of this maillist
really seem to be on the ball.

We receive a lot of spam from a particular group. Each mailing is from
various sources, but all have the following line in them(actually a reply
link where I have replaced the real address with x's, y's, etc):

 visit at  <>

I would like to use a body or rawbody (uri or full maybe?) rule to find
"html://" and give it a score in SA by adding it to my
spam.assassin.prefs.conf file but have not yet figured out how to write it.
My Header rules work fine, but all of my attempts at this seem to be all for

Any help would be appreciated and sorry for the non-MS stuff.

steve campbell
campbell at <mailto:campbell at>

-------------- next part --------------
An HTML attachment was scrubbed...

More information about the MailScanner mailing list