Some archive searching has revealed that multi-line matching isn't available yet. Is there another way to rework this rule that I'm missing, using meta rules perhaps? It would single-handedly get a lot of spam that I get, which is consistantly of the form of three "ambiguous product pitch:\nurl\n\n"s. My email address appears in the third URL, and the first two are mostly numeric.
rawbody L_3_Part_Pitch_Spam /.*:\nhttp:\/\/[a-z]{2}[0-9]\.\w{1,20}\.com\/([0-9]*\/)*[a-z]{1,20}\. htm(l)?\n\n.*:\nhttp:\/\/[a-z]{2}[0-9]\.\w{1,20}\.com\/([0-9]*\/)*[a-z] {1,20}\.htm(l)?\n\n.*:\nhttp:\/\/[a-z]{2}[0-9]\.\w{1,20}\.com\/([EMAIL PROTECTED] *\/)*\/.htm(l)?/ describe L_3_Part_Pitch_Spam Mail has six lines, three are URLS Thanks, sckot Vokes -- "I wish I had a 2 liter of Pepsi in my box of replacement staples, so if they needed to quench their thirst, then they could ride the snake." -Kefka P ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk