On Tue, 12 Feb 2019, Rupert Gallagher wrote:
Let see if the mail arrives with the correct escaping this time.
body __HAS_URI /(http|https):\/\//
tflags __HAS_URI multiple
meta TMU ( _HAS_URI > 10 )
describe TMU Too many URIs (>10)
score TMU 5.0
How about:
uri __HAS_URI /^http/i
tflags __HAS_URI multiple, maxhits=11
etc.
As rightly noted, the same link is counted twice, for text and html bodies when
they are present. However, my corpus has more of the odd type, where the text
and the html parts are different: if you switch from text to html you read a
different message for the same email. Those who fill their emails with lots of
useless pics get the spam rating they deserve, so I intentionally count all
links.
I feel more than generous with 5+5 links, but if you want more, or less, you
can easily change to fit your local policy.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The world has enough Mouse Clicking System Engineers.
-- Dave Pooser
-----------------------------------------------------------------------
Today: Abraham Lincoln's and Charles Darwin's 210th Birthdays
