On Mon, 2013-10-28 at 21:42 -0400, Alex wrote:
> > "The 'raw body' of a message is the raw data inside all textual parts.
> > [...] HTML tags and line breaks will still be present."
> >
> > If you don't want to match e.g. HTML tags, use a body rule instead.
> I knew this, but guess I assumed th
Hi,
> "The 'raw body' of a message is the raw data inside all textual parts.
> [...] HTML tags and line breaks will still be present."
>
> If you don't want to match e.g. HTML tags, use a body rule instead.
>
>> Here's an example of a typical short-body spam I receive:
>>
>> http://pastebin.com
On Mon, 2013-10-28 at 19:53 -0400, Alex wrote:
> > rawbody __RB_GT_200 /^.{201}/s
> I'm still having a problem with messages that do actually contain a
> short body. The HTML component is considered as part of the whole
> message, so RB_GT_200 is hitting.
Please read the docs [1], about what rawb
On Mon, 2013-10-28 at 19:30 -0400, Alex wrote:
> > > think I should have an exclusion for messages that contain a
> > > significant attachment.
> After thinking about it, I think I'd like to detect any attachment,
> including those images typically found in signatures.
>
> > mimeheader __MIME_I
Hi,
> Okay, I've modified the rule:
>
> rawbody __RB_GT_200 /^.{201}/s
> meta __BODY_LE_200 (__RB_LE_200 == 1) && !__RB_GT_200
> meta __RB_LE_200 !__RB_GT_200# less or equal IFF not greater
> mimeheader __MIME_IMAGE Content-Type =~ /^image\/./
> mimeheader __MIME_ATTACH Content-Disposition =
Hi,
On Fri, Oct 25, 2013 at 9:40 PM, Karsten Bräckelmann
wrote:
> On Fri, 2013-10-25 at 19:12 -0400, Alex wrote:
>> I've created a bunch of rules that are intended to detect short body's
>> meta'd with a missing subject. I thought it was working okay, but I
>> think I should have an exclusion for
On Fri, 2013-10-25 at 19:12 -0400, Alex wrote:
> I've created a bunch of rules that are intended to detect short body's
> meta'd with a missing subject. I thought it was working okay, but I
> think I should have an exclusion for messages that contain a
> significant attachment.
Assuming a loose in
Hi guys,
I've created a bunch of rules that are intended to detect short body's
meta'd with a missing subject. I thought it was working okay, but I
think I should have an exclusion for messages that contain a
significant attachment. I'd appreciate it if someone could help me
review my rules and sh
