Joseph Brennan wrote:
>
> How would I match on a URL like the text below? This does not work:
>
> rawbody CU_0A /www\.[a-z]+\.(com|cn)=0A=/
>
> Rawbody evidently sees it after it has been decoded from
> quoted-printable.
> The needless use of qp is actually a distinctive sign of this spammer.


Use the "full" type.. however, beware this brings in the headers and the
body.