body and uri rules fail to work on the email.  How do I get a rule to pass on this message? Here's the message details:

Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 1529 invoked by uid 89); 10 Nov 2006 19:17:11 -0000
Received: by simscan 1.1.0 ppid: 1523, pid: 1524, t: 4.4114s
scanners: attach: 1.1.0 clamav: 0.88.5/m:40/d:2133 spam: 3.0.4
Received: from unknown (HELO yahoo.es) (196.200.192.131)
by redac.redacted.com with SMTP; 10 Nov 2006 19:17:07 -0000
Received-SPF: none (redac.redacted.com: domain at yahoo.es does not designate permitted sender hosts)
Received: from mail.webhostings4u.com ([Sat, 11 Nov 2006 00:01:19 +0400])
by relay.2yahoo.com with ASMTP; Sat, 11 Nov 2006 00:01:19 +0400
Received: from [195.174.170.248 ] by smtp18.yenddx.com with ESMTP; Fri, 10 Nov 2006 23:44:17 +0400
Received: from unknown (134.251.157.192)
by smtp.mixedthings.net with ESMTP; Fri, 10 Nov 2006 23:31:31 +0400
Message-ID: <[EMAIL PROTECTED]>
Date: Fri, 10 Nov 2006 23:27:28 +0400
From: "Sal" < [EMAIL PROTECTED]>
MIME-Version: 1.0
To: "Forum-Members" <[EMAIL PROTECTED]>
Subject: hey redacted
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: base64
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on redac.redacted.com
X-Spam-Level:
X-Spam-Status: No, score= 0.1 required=5.0 tests=MIME_BASE64_TEXT autolearn=no
version=3.0.4

U1RFVkUsDQpNZWRpY2FsIFJlLWZpbGwgIGlzIHJlYWR5Lg0KDQpodHRwOi8vZ2VvY2l0aWVzLnlh
aG9vLmNvbS5ici94ZXhhZzM5NTEyDQoNCiBUaGFuayB5b3UsDQpTYWwNCg==


On 11/8/06, Theo Van Dinter <[EMAIL PROTECTED]> wrote:
On Wed, Nov 08, 2006 at 02:56:26PM -0500, Steven Kiehl wrote:
> Is there a way to get rules to pass for both plain and base64 encoded
> messages?

SA handles quoted-printable and base64 encodings, so yes, already happens.

> My current rule that failed is like this:
> body IPBL_6        /geocities\.com\//i

Perhaps you want a uri rule instead?

--
Randomly Selected Tagline:
"Sex is like air; it's not important unless you aren't getting any."
         - Zen Musings



Reply via email to