I made a custom rule in local.cf to score the following with 5:
describe custom_body_checksCustom Body Checks
score custom_body_checks5
rawbody __bc_0 /%RND_ALT/I
meta custom_body_checks ( __bc_0 )
But it is not catching that phrase in the inbound e-mail. (below)
Can anyone tell me why? I have tons of other rules that get caught and marked,
but this one seems to sneak by.
Stuck on spamassassin-2.55-2.1.92 for now on a Mandrake 9.2 machine.
Thanks,
-=Ray
Good flying never killed [an enemy] yet.
Major Edward "Mick" Mannock, RAF, WWI, 50-73 Victories
Here is a snip of the original e-mail (hope it doesn't get caught)
= SNIP
X-Spam-Status: No, hits=0.1 required=3.0
tests=HTML_MESSAGE
version=2.55
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
A40863880133651
Content-Type: multipart/alternative;
boundary="--A95370304846963"
A95370304846963
Content-Type: text/plain;
Charset = "us-ascii"
Content-Transfer-Encoding: 7bit
--- cut html crap -
%RND_ALT%RND_ALT%RND_ALT
--- cut html crap -
A95370304846963
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
--- cut html crap -
%RND_ALT%RND_ALT%RND_ALT
--- cut html crap -
A95370304846963--
A40863880133651
Content-Type: image/gif; name="vicodinad.gif"
Content-Transfer-Encoding: base64