I implemented a rule that looks for multiple breaks for just that reason.
Can't remember where I "stole" it from - probably some folks here helped me
with it a few years ago. Can't remember who, but appreciated the assistance.
##########################################################################
# - Find messages with eight or more html break characters in it.
##########################################################################
rawbody CBJ_GiveMeABreak /(?:<br\/?>[\s\r\n]{0,4}){8}/mi
describe CBJ_GiveMeABreak Messages with consecutive break characters
score CBJ_GiveMeABreak 2.0
...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4500
Registered Linux User No: 307357
-----Original Message-----
From: James B. Byrne [mailto:byrn...@harte-lyne.ca]
Sent: Wednesday, May 14, 2014 1:08 PM
To: users@spamassassin.apache.org
Subject: Bayes refinement
Is there any way to limit Bayes content checking to only the first X characters
of the message body? I ask this because it is clear that the spam messages
getting through contain text meant to poison the tests but this gibberish
always trails the main message and is separated by a large white space in most
cases.
--
*** E-Mail is NOT a SECURE channel ***
James B. Byrne mailto:byrn...@harte-lyne.ca
Harte & Lyne Limited http://www.harte-lyne.ca
9 Brockley Drive vox: +1 905 561 1241
Hamilton, Ontario fax: +1 905 561 0757
Canada L8E 3C3
