On Mon, 6 Jul 2009 17:58:59 -0500 info-spamassassin-t...@cs.utexas.edu wrote:
> I seem to be having a hard time writing rules which anchor > a string to the start of the line in the body of a text message. > > e.g., suppose I get a lot of phish which contain text (not html) > like this: > > Username:.......... > Password:.......... > > I try what seemed intuitively easy: > > body __PHISH1 /^Password\b/i > body __PHISH0 /^Username\b/i > meta PHISH __PHISH1 && __PHISH0 As has already been said, line-breaks are removed in body tests, but even if they weren't, the test would be likely to FP on website sign-up replies. It might be better to looks for "username" and "password" separated by a suitable pattern of whitespace and punctuation.
