Charles Gregory wrote:
> I've been scoring the attachment name pattern with a 'full' test.
> But this will only work until they figure ways to randomize the
> attachment names....
The mimeheader plugin can do that and is much cheaper.
The
<STYLE>
Abody
Ahead
</STYLE>
part of the HTML seems to be a good spam sign, too. I can’t come up with
a test (other than a full test) that will actually match all of that
with 3.2.x: the rawbody rule matches one line at a time. A meta on both
Abody and Ahead in the rawbody seems to do a pretty good job.
To what extent should Windows Mail be counted as a variant of
Outlook/Outlook Express? It’s not caught in __ANY_OUTLOOK_MUA: should it
be?
Hope this helps,
James.
--
E-mail: james@ | ... a sign carefully conveying in pictograms the fact
aprilcottage.co.uk | that you should not leave wheelchairs on a certain river
| bank as they would roll down the hill and the crocs would
| eat the passenger. -- Skud
