On Fri, 9 Oct 2009, MySQL Student wrote:
* 1.5 MY_CID_AND_ARIAL2 SARE CID and Arial2
* 1.6 PART_CID_STOCK Has a spammy image attachment (by Content-ID)
* 1.5 MY_CID_AND_STYLE SARE cid and style
* 1.6 MY_CID_ARIAL_STYLE SARE cid arial2 style
Even if I remove the RELAYCOUNTRY_HIGH meta, it's still over the 5.0
threshold.
It looks like you might have more than one rule hitting on the same
condition there. You might want to OR-meta those MY_ rules together into a
single rule.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Judicial Activism (n): interpreting the Constitution to grant the
government powers that are popularly felt to be "needed" but that
are not explicitly provided for therein (common definition);
interpreting the Constitution as it is written (Brady definition)
-----------------------------------------------------------------------
8 days since a sunspot last seen - EPA blames CO2 emissions