Stupid rule question

[Michael W Cocke <co...@catherders.com>]

This is really getting on my nerves...  Using Spamassassin 3.03, could
someone please tell me why this message

-------------------------
Dear Customer, 

We have all the rx you may need.

http://americaspharma.com/

>>From hard to find pain killers to diet solutions.

Thank you,

Supply.
----------------------------

Isn't getting caught by this rule?

body		MWC19  /americaspharma.com/i
describe	MWC19	local rule19
score		MWC19	20.0


Thanks!  I'm getting at least one - more likely 3-6 _every_ day.
(and I feed them to bayes every day - and they're still coming thru.

Mike-
 
--
Mornings:  Evolution in action.  Only the grumpy will survive.
--

Please note - Due to the intense volume of spam, we have installed site-wide spam
 filters at catherders.com.  If email from you bounces, try non-HTML, non-encoded, 
non-attachments.

Re: Stupid rule question

[Kevin Peuhkurinen <ke...@meridiancu.ca>]

Michael W Cocke wrote:
> This is really getting on my nerves...  Using Spamassassin 3.03, could
> someone please tell me why this message
> 
> -------------------------
> Dear Customer, 
> 
> We have all the rx you may need.
> 
> http://americaspharma.com/
> 
>>>From hard to find pain killers to diet solutions.
> 
> Thank you,
> 
> Supply.
> ----------------------------
> 
> Isn't getting caught by this rule?
> 
> body		MWC19  /americaspharma.com/i
> describe	MWC19	local rule19
> score		MWC19	20.0
> 

Possibly the URL is split over several lines with CRs in the message body?

Re: Stupid rule question

[Matt Kettler <mk...@comcast.net>]

At 10:52 AM 5/9/2005, Michael W Cocke wrote:
>Isn't getting caught by this rule?
>
>body            MWC19  /americaspharma.com/i
>describe        MWC19   local rule19
>score           MWC19   20.0

change it from a body rule to a uri rule,  also for correctness add a \ in 
front of . (otherwise . is a wildcard)

uri     MWC19   /americaspharma\.com/i

Body rules run on the message with most html tags stripped out. Since you 
just sent us a copy of the body text and not the true, raw message, it's 
not clear why the rule didn't match, but it might have been done with some 
HTML tricks that a uri rule should deal with.

Another alternative is to use rawbody, but that doesn't deal with 
linewraps, so use with caution.