>...
>
>At 08:17 AM 6/3/2005, Sven Riedel wrote:
>>I've recently started getting spams that contain as a body the exact
>>same string as the subject and one URI underneath.
>>
>>Is there any way to carry the result of one match forward to another?
>
>That's tricky, but you might be able to use the fact that SA treats the
>subject as a part of the body to help out.. Use () to capture the subject
>and then have a backreference.
>
>Something like this *might* work, but I'd have to test it.
>rawbody BODY_SUBJECT /Subject\: \s*(\b.+)\n\s*\1/m
>
>
It might just be a style issue, but the potential for FPs is very
high. I know I often use as the subject a phrase or sentence that will/does
recur near the beginning of the message.
If the test were for "exactly" what the OP described, I think it
would be safe: The rule suggested would probably hit ~25% of the email
I originate/send (i.e. not replies).
Paul Shupak
[EMAIL PROTECTED]
