Hi, >> http://pastebin.com/DVEGBE3j >> http://pastebin.com/Z97tBVE4 >> > I'm recognising bodies that contain just a URL with metarule, > MG_BARE_URL, that ANDs this: > > rawbody __MG_BU1 /^\s{0,10}(\S{1,80}|http:\S{1,70})\s{0,10}$/ > > with either this: > > body __MG_BU2 /http:\S{1,70}/i > > or a domain thats in a private URIBL. Finally, I'm using another meta > that fires if the msg-id says that yahoo originated the message. > > That caught both of your examples.
That seems to help, thanks. I've also been using your yahoo msg-id rule for some time, and have had some success with it. Not sure why it didn't trigger here with the samples I posted. Kris, thanks for your help as well. It looks like body checks are all that's feasible with spam like this. Thanks, Alex
