On Sat, 2013-07-06 at 12:24 -0700, Celene wrote:
> To be honest, I have never gotten any emails from people with only a
> URL, unless they are spam, so this shouldn't be a problem. I just want
> to match all emails that have a single link in the body
I'm getting reasonable results from this:
rawbody MG_BARE_URI /^\s{0,10}(http:|www\.)\S{1,70}\s{0,10}$/i
though I'm using it as part of a meta-rule that applies further checks
if and only if this rule fires. It seems to be sufficiently specific:
when I ran it against the spam collection I use for regression testing
rules (849 spams) it only fired on the ones I expected it to recognise.
Martin
