From: "Robert Menschel" <[EMAIL PROTECTED]>
> Hello jdow,
>
> Friday, May 6, 2005, 4:21:49 AM, you wrote:
>
> j> From: "Cialis $89, Soma $59, Viagra $69" <[EMAIL PROTECTED]>
>
> j> Guess what? It passes right through all the tests because the drugs
> j> are never mentioned in the body of the mail.
>
> The next version of the SARE header rules should help out...
>
> Bob Menschel
This helps, too, Bob. {^_-} Do it to me once and I suggest a new rule.
Do it to me twice and you get insulted. {^_-}
===8<---
header JD_FROM_DRUG_1 From =~ /[viagra|cialis| soma]\b/i
describe JD_FROM_DRUG_1 Sneaky drug twerbles
score JD_FROM_DRUG_1 10
===8<---
I'll be sure to install the new rules because I expect someone will
start obfuscating it. Of course "$" and "dollars" and other currency
notations probably do not appear in many ham from headers. So that's
held in reserve.
{^_-}
