I like it! On Tue, Feb 12, 2019 at 18:15, John Hardin <jhar...@impsec.org> wrote:
> On Tue, 12 Feb 2019, Rupert Gallagher wrote: > >> Let see if the mail arrives with the correct escaping this time. >> >> body __HAS_URI /(http|https):/// >> tflags __HAS_URI multiple >> meta TMU ( _HAS_URI > 10 ) >> describe TMU Too many URIs (>10) >> score TMU 5.0 > > How about: > > uri __HAS_URI /^http/i > tflags __HAS_URI multiple, maxhits=11 > etc. > >> As rightly noted, the same link is counted twice, for text and html bodies >> when they are present. However, my corpus has more of the odd type, where >> the text and the html parts are different: if you switch from text to html >> you read a different message for the same email. Those who fill their emails >> with lots of useless pics get the spam rating they deserve, so I >> intentionally count all links. >> >> I feel more than generous with 5+5 links, but if you want more, or less, you >> can easily change to fit your local policy. > > -- > John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > ----------------------------------------------------------------------- > The world has enough Mouse Clicking System Engineers. > -- Dave Pooser > ----------------------------------------------------------------------- > Today: Abraham Lincoln's and Charles Darwin's 210th Birthdays
