[Mimedefang] SpamAssassin regexp question

Jim McCullars jim at info.uah.edu
Wed Jul 30 11:47:56 EDT 2008


List:

   I'm a little embarrassed asking this, but I have a SA test that I think
should work but does not.  We are getting a lot of spam that have lines
like this at the bottom:

This email was sent by:
Direct Media
48 Lakeside Dr.
Ronkonkoma,New York 11779
Unsubscribe: http://BASEAGENT.COM/bwRILANvBg/wvwI/wAvRRBARB/R/accounts

So I tried adding these to my spamassassin config file:

# This mail was sent by...
rawbody UAH_SENTBY1 /^This email was sent by:$/
score UAH_SENTBY1 1.0
rawbody UAH_SENTBY2 /^Unsubscribe: http:.+\/accounts$/
score UAH_SENTBY2 1.0

When I ran command line spamassassin against a copy of the message, the
tests did not hit.  When I changed it to this:

# This mail was sent by...
rawbody UAH_SENTBY1 /\nThis email was sent by:\n/
score UAH_SENTBY1 1.0
rawbody UAH_SENTBY2 /\nUnsubscribe: http:.+\/accounts\n/
score UAH_SENTBY2 1.0

they did.  What's the difference?  Thanks...

Jim McCullars
University of Alabama in Huntsville





More information about the MIMEDefang mailing list