I need a rule that will tag a message that has nothing in the body except a single link, as in the following:

[headers snipped]

MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Spam-Status: No, score=2.0
X-Spam-Score: 20
X-Spam-Bar: ++
X-Spam-Flag: NO

http://kundalinicentrobenessere.it/mas5.html

[end]

This is pretty typical of a lot of the spam coming in recently. Most of them have no subject, and I've already boosted my MISSING_SUBJECT up to 1.0 (I trigger a spam tag at 3.0) but these are still getting through untagged.

I don't automatically delete the tagged messages, so I WOULD be able to check for false positives. But for the purposes of our emails, a single link in the body is virtually always a piece of spam.

Sorry, I don't know what version of SA we're running. I could check with my host if that's critical. I can't find that info in the CPanel or SA configuration page.