> describe MY_RBDY_INVSTXT MY: Invisible text color > rawbody MY_RBDY_INVSTXT /<font\s?.* > color=("?\#?FFFFF[0-9A-F]"?|"?white"?).*>/i > score MY_RBDY_INVSTXT 2.0
Just my $0.02, but I'd make it this: color=("?\#?F[0-9A-F]F[0-9A-F]F[0-9A-F]"?|"?white" .. spammers will use more than just the last byte of the color to make something a shade of "white". Your rule would catch #FFFFFE etc but not #FEFFFF or #FFFEFF ... which will appear just as 'white'. -id ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk