Loren Wilton wrote: > > > Now, that said, the forwarded Blackberry message you posted would not > have hit the rule in the first place, unless someone took my original > rule and modified it. So you not only don't have a standard config, > you have apparently locally-modified versions of rules you have picked > up elsewhere. And it is that locally-modified rule that is hitting on > your Blackberry messages. Wow.. you're right Loren, LW_STOCK_SPAM4 should not have hit.
I just assumed the __RATWARE_0_TZ_DATE half was picking up on the lack of a valid timezone. It's looking for the timezone to literally be "+0000", which it is not. I over-looked that entirely. Jo, can you check your copy of this rule? The relevant bits should be: header __RATWARE_0_TZ_DATE Date =~ /\s\+0000$/ meta LW_STOCK_SPAM4 __RATWARE_0_TZ_DATE && MIME_BASE64_TEXT score LW_STOCK_SPAM4 1.66 describe LW_STOCK_SPAM4 Yup, its a spam!
