> I think that html mail which bgcolor is not white is probably spam.
> So I made a rule like this.
This rule will hit A LOT of normal HTML ham for most people, so it would be
a good idea to score it much lower.
While the rules you write are syntactically correct, they will probably hit
a whole lot of things you do not want them to hit, and will also probably
miss exactly what you are looking for.
You want to find the word 'bgcolor' within a tag, not within the body of the
formatted message. So you would have to look in 'rawbody' rather than
'body' to find it there.
Also, you are not checking to see if the word is enclosed in a tag. SO this
message would get a hit on the bgcolor rule, because the word occurs in
text.
You are also checking for other words like 'white', but you are not checking
if they are in the same tag with bgcolor. So again, this message will
trigger your meta, because both bgcolor and white appear in the message. In
fact <bgcolor=#000000> <fontcolor=white> will trigger your test.
Rather than trying to make this rule correct, which will take a number of
attempts, go over to www.rulesemporium.com and pick up some of the rule
sets. We have some that check both background and foreground colors and
will give high scores if both colors are the same or nearly the same. If
you really want to score just a colored background high, I believe you could
just change the score on some of our rules.
Loren
