> There is definitely a VERY significant performance penalty to using > rawbody over URI, for any rule. > > Consider the size of input. A rawbody regex must be run against the > entire text of the body after QP decoding. A uri regex must be run > against all the text of the URIs that SA found. There is likely to be at > least a 100:1 difference in size of input. There's no "penalty" for > using a uri rule, as SA will always extract all the URIs and build the > input text, even if you aren't using it. > > However, there are some cases where rawbody is useful, particularly when > you want to examine the formatting of newlines inserted into a HTML tag. > > rawbody is also useful when you're looking for a "new trick" the > obfuscates URIs in such a way that SA can't parse them, but outlook can > still open them. This used to be common enough that most folks used > rawbody for all their URI type rules. However, nowadays most of them are > caught.
Will URI catch a plain text message with url , not hyperlinked. By sending a text url the spammer purpose is solved because I think mail clients hyper link plain text url's themselves. Thanks Ram
