I'm no expert so I may be off-base here, but shouldn't the rule have ()?
body RULE_NAME /(bannedc|banned c)/i
I think that without them you're scanning for one of the following strings:
"bannedcanned c" or "bannedbanned c".
Sandy
- Original Message -
From: "John McGivern" <[EMAIL PROTECT
In cases where both sections are an advertisement it should pick
up the appropriate tokens from the HTML section, and in other cases the
plain text section is probably just Bayes poison anyway.
Just a thought
Sandy S.
Here's a sample of the body of one of these spams:
--=_NextPart
I've been seeing this too, so I added the following rule to my local.cf:
header __TEXT_HTML_BA Content-Type =~ /text\/html/i
meta NO_BODY_BA __TEXT_HTML_BA && !HTML_MESSAGE
describe NO_BODY_BA Message with no body
score NO_BODY_BA 4
It's been working great for me.
Sandy
quot;, etc.
I'm playing with Chris's OBFU rules, but I'll keep watching the list for
more ideas, too - I'd love to be able to catch these!
Sandy S.
- Original Message -
From: "Daniel Carrera" <[EMAIL PROTECTED]>
To: "SpamAssassin list" <[EM
