How would I match on a URL like the text below? This does not work:

rawbody CU_0A /www\.[a-z]+\.(com|cn)=0A=/

Rawbody evidently sees it after it has been decoded from quoted-printable.
The needless use of qp is actually a distinctive sign of this spammer.

Joseph Brennan
Columbia University Information Technology

------------------


Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


=0A=
Soma - real expert in fighting muscle pains=0A=
=0A=
www.fordiscountpharm.com=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=
=0A=