At 08:53 PM 7/14/2005, Dr Robert Young wrote:
Is there a rule that would allow one to score an email with an embedded
graphic to a negative spam value, no matter what else was in the body???
To a negative value? or positive value??
I assume you mean positive since you want to tag it...
Something like this rule will look for a HTML img tag referencing an
embedded image
rawbody L_EMBEDDED_GFX /img src ?\=.{1,20}\bcid\:/
However, be wary, there's probably a lot more nonspam out there that
contains embedded images than you think.
This includes a lot of newsletters as well as personal emails that have
those stupid HTML-graphic signatures at the bottom so their e-mail
signature looks just like their business card.
If spam that has embedded images is a problem for you, and network checks
are feasible you might want to consider using razor. It's signature
database is done on a per-mime-section basis, so it can recognize a common
spam image even if the body changes. Downsides are it's not free for really
high-volume sites and it's a network check, thus can be slow if the network
is overloaded.
