How would I match on a URL like the text below? This does not work:
rawbody CU_0A /www\.[a-z]+\.(com|cn)=0A=/ Rawbody evidently sees it after it has been decoded from quoted-printable. The needless use of qp is actually a distinctive sign of this spammer. Joseph Brennan Columbia University Information Technology ------------------ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =0A= Soma - real expert in fighting muscle pains=0A= =0A= www.fordiscountpharm.com=0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A=
