Dear Rupert,
Many thanks for your configuration you posted. I installed your ruleset but unfortunately it didn’t not trigger. I run “spamassassin -D < “ redirecting from a text file too and it doesn’t show this rule. But other local rules are triggered which I add. Obviously it does not recognize these url’s. I played around a little bit with the “full” statement but without success. Also with a simplified regex. Finally I saw you missed an underscrore in “meta” statement. It should be: meta TMU ( __HAS_URI > 10 ) And the “full” statement should be: full __HAS_URI /(http|https):\/\// I post this to the mailing list because it could be useful for others too. This is the mail body with which I made some tests: https://ajnsxz.com/?ajnsxz ajnsxz https://befghkp.ua/?befghkp befghkp https://ailswy.ua/?ailswy ailswy https://efjqsxy.ua/?efjqsxy efjqsxy http://dfhtv.ua/?dfhtv dfhtv https://begimrv.ua/?begimrv <https://begimrv.ua/?begimrv> begimrv https://jlprv.net/?jlprv <https://jlprv.net/?jlprv> jlprv http://efhsz.ua/?efhsz efhsz https://dgiqs.ua/?dgiqs dgiqs http://bgiprx.net/?bgiprx <http://bgiprx.net/?bgiprx> bgiprx https://cdklmqv.biz/?cdklmqv <https://cdklmqv.biz/?cdklmqv> cdklmqv https://adgnowz.ua/?adgnowz <https://adgnowz.ua/?adgnowz> adgnowz http://cfjnorty.ru/?cfjnorty <http://cfjnorty.ru/?cfjnorty> cfjnorty https://bcfhpqvy.ru/?bcfhpqvy <https://bcfhpqvy.ru/?bcfhpqvy> bcfhpqvy http://beiqv.biz/?beiqv <http://beiqv.biz/?beiqv> beiqv I learned a lot. Your reply was very helpful. Kind regards Hans From: Rupert Gallagher <r...@protonmail.com> Sent: Thursday, February 7, 2019 7:37 PM To: MAYER Hans <hans.ma...@iiasa.ac.at>; SA <users@spamassassin.apache.org> Subject: Re: RE: New type of SPAM aggression full __HAS_URI /(http|https):/// tflags __HAS_URI multiple meta TMU ( _HAS_URI > 10 ) describe TMU Too many URIs (>10) score TMU 5.0 On Thu, Feb 7, 2019 at 09:12, MAYER Hans <hans.ma...@iiasa.ac.at<mailto:hans.ma...@iiasa.ac.at>> wrote: > … All emails were spam with links. … We receive such spam mails with a lot of links too. Is there a rule which detects a certain amount of links inside an e-mail ?
