Rosenbaum, Larry M. wrote:
> This matches the spam message, but it also matches messages where the
> number is followed by a blank line and more text, which is a false
> positive.
>
> In all cases I got the same results. What am I missing?
Try a compound rule. Look for the number, and then anything that's not
a number. (Mind the line wrapping, of course.)
body ORNL_B0RKEN1_SHORTNUM /^\d{3,5}\n{1,3}$/s
body ORNL_B0RKEN1_BODYTEXT /[a-zA-Z]/
meta ORNL_B0RKEN1 (ORNL_B0RKEN1_SHORTNUM &&
ORNL_B0RKEN1_BODYTEXT)
describe ORNL_B0RKEN1 B0rken spamware, message just
contains a short number
score ORNL_B0RKEN1 1.0
That'll prevent the rule from matching if there's so much as a single
letter in the body.
