You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Joseph Brennan <br...@columbia.edu> on 2008/04/06 04:13:32 UTC
Really raw body
How would I match on a URL like the text below? This does not work:
rawbody CU_0A /www\.[a-z]+\.(com|cn)=0A=/
Rawbody evidently sees it after it has been decoded from quoted-printable.
The needless use of qp is actually a distinctive sign of this spammer.
Joseph Brennan
Columbia University Information Technology
------------------
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
=0A=
Soma - real expert in fighting muscle pains=0A=
=0A=
www.fordiscountpharm.com=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
Re: Really raw body
Posted by Matt Kettler <mk...@verizon.net>.
Joseph Brennan wrote:
>
> How would I match on a URL like the text below? This does not work:
>
> rawbody CU_0A /www\.[a-z]+\.(com|cn)=0A=/
>
> Rawbody evidently sees it after it has been decoded from
> quoted-printable.
> The needless use of qp is actually a distinctive sign of this spammer.
Use the "full" type.. however, beware this brings in the headers and the
body.