On Wed, Nov 01, 2006 at 08:14:39AM -0500, Tim Boyer wrote: > Last week I added a rule to tag those annoying .gif pump-and-dump emails. > Nothing fancy: > rawbody IMG_SRC_CID /src\=(\"c|c)id\:/i
There are several issues with this rule IMO, but there's already a very similar rule available via sa-update: 16.856 20.0630 0.3170 0.984 0.77 1.00 __TVD_INT_CID which shows that it hits a lot of ham (0.32%), but also hits 20% of spam. It's good enough for a meta dependency, but not necessarily as a rule for itself, though YMMV. -- Randomly Selected Tagline: "It is sometimes fun to scare people... Especially Matt." - Michelle
pgpgoy1RG79RF.pgp
Description: PGP signature
