Someone just had some ham get hit by KAM.cf. Why would the rule KAM_HOODIA contain merely the number 920+ found in subject and body be a hit. According to the rule, one point for header, one for body and if two or more found, it hits. I had a reservation department not receive a confirmation notice at a hotel because the confirmation number in both the header and body started with 920 :\
#HOODIA header __KAM_HOODIA1 Subject =~ /(hoodia|920+)/i body __KAM_HOODIA2 /(hoodia|920+)/i body __KAM_HOODIA3 /fat loss product/is meta KAM_HOODIA (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3 >= 2) describe KAM_HOODIA Hoodia Product Promotion Spam score KAM_HOODIA 6.0 How can I write a rule to lower this score if not all 3 hit to cover me if future KAM.cf updates are not fixed? Never done it before, would it be something like: meta KAM_HOODIA_FIX (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3 < 3) describe KAM_HOODIA_FIX Need to hit all three KAM HOODIA rules. score KAM_HOODIA_FIX -2.0 -- Robert
