Here's another email with a problem, the comments test has been fired but there is no html portion, there are <! in the winmail.dat attached file that seems to be triggering it.
Is it possible to make this test just look inside Content-Type: text/html sections or even <html> open and close tags?
Not at this time. That's going to require full MIME decoding, which is going to be a lot of work. What you can do in this case is set up the COMMENTS test to require a minimum number of anti-filter comments, such as:
COMMENTS comments 10 x 5 0
That would require there to be at least 10 anti-filter comments before the test would be triggered (the 5 means that a weight of 5 would be added to E-mails that fail the test).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
