On Wed, 13 Dec 2006, vertito wrote:
> I have this rule from local.cf
>
> body MY_harsh_content_RULE18 /cid:/is
> describe MY_harsh_content_RULE18 Harsh body content
> score MY_harsh_content_RULE18 5.0
>
> but still I am receiving this HTML spam emails that scores lower than 2.0.
> The ae above rules doesnt catch the said HTML spam email from yahoo.
>
> And the only signature I can find is it has "cid:" inside the body of that
> HTML spam email.
>
> See attached image.
Go get the SARE "70_sare_html.cf" and "70_sare_stocks.cf" rule sets.
They look for 'cid:' with other factors to try to get a spammy-ness
evaluation of a message. They use 'meta' rules to combine different
factors to try to reduce the FP rates.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
