On Thu, 7 Feb 2019, Rupert Gallagher wrote:
full __HAS_URI /(http|https):///
tflags __HAS_URI multiple
meta TMU ( _HAS_URI > 10 )
describe TMU Too many URIs (>10)
score TMU 5.0
Beaware, if the mail has properly-formed HTML and plain-text alternate
versions, that will double-count every URI.
Also, if you only care about more than ten hits, add
tflags __HAS_URI maxhits=11
...to avoid matching ones you don't care about.
On Thu, Feb 7, 2019 at 09:12, MAYER Hans <hans.ma...@iiasa.ac.at> wrote:
… All emails were spam with links. …
We receive such spam mails with a lot of links too.
Is there a rule which detects a certain amount of links inside an e-mail ?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The difference between ignorance and stupidity is that the stupid
desire to remain ignorant. -- Jim Bacon
-----------------------------------------------------------------------
5 days until Abraham Lincoln's and Charles Darwin's 210th Birthdays
