Body SA rule

Stephe Campbell campbell at CNPAPERS.COM
Tue Mar 18 15:50:19 GMT 2003


Mr. Winkler,

Thank you very much. That seemed to work, although I think I may have tried that same rule you provided. The difference was I used a rule name with a hyphen instead of underscore. Do you know if that is a real issue? I might be wrong though on whether I used your regexp prior, I tried so many.

Thanks again

Steve Campbell
campbell at cnpapers.com
  ----- Original Message ----- 
  From: Derek Winkler 
  To: MAILSCANNER at JISCMAIL.AC.UK 
  Sent: Tuesday, March 18, 2003 10:30 AM
  Subject: Re: Body SA rule


  Here's one I use...

  rawbody LOCAL_CNTNTFRM_vresp    /https?:\/\/.*?\.vresp\.com/i
  describe LOCAL_CNTNTFRM_vresp   Has "http://*.vresp.com" in body
  score LOCAL_CNTNTFRM_vresp      3

  In the reg exp /s and .s must be preceded by \, makes it confusing. The ? makes the s optional so http or https will work. The i after the final / means case insensitive.

  Your reg exp would be "/http:\/\/www\.xx-yyyyy\.com/" off the top of my head anyways.
    -----Original Message-----
    From: Stephe Campbell [mailto:campbell at cnpapers.com]
    Sent: Tuesday, March 18, 2003 10:19 AM
    To: MAILSCANNER at jiscmail.ac.uk
    Subject: Body SA rule


    This is not a MS problem, but I have yet been able to find anything in the SA archives and hope that someone using MS has done this before. I'm not versed in Perl, so I sort of need assistance. The people of this maillist really seem to be on the ball.

    We receive a lot of spam from a particular group. Each mailing is from various sources, but all have the following line in them(actually a reply link where I have replaced the real address with x's, y's, etc):


     visit at http://www.xx-yyyyy.com/34606zzz.html

    I would like to use a body or rawbody (uri or full maybe?) rule to find "html://www.xx-yyyyy.com" and give it a score in SA by adding it to my spam.assassin.prefs.conf file but have not yet figured out how to write it. My Header rules work fine, but all of my attempts at this seem to be all for nothing.

    Any help would be appreciated and sorry for the non-MS stuff.



    steve campbell
    campbell at cnpapers.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030318/ef5d1c25/attachment.html


More information about the MailScanner mailing list