I made a custom rule in local.cf to score the following with 5:
describe custom_body_checks Custom Body Checks
score custom_body_checks 5
rawbody __bc_0 /%RND_ALT/I
meta custom_body_checks ( __bc_0 )
But it is not catching that phrase in the inbound e-mail. (below)
Can anyone tell me why? I have tons of other rules that get caught and marked,
but this one seems to sneak by.....
Stuck on spamassassin-2.55-2.1.92 for now on a Mandrake 9.2 machine.
Thanks,
-=Ray
------------------------------------------------
Good flying never killed [an enemy] yet.
Major Edward "Mick" Mannock, RAF, WWI, 50-73 Victories
Here is a snip of the original e-mail (hope it doesn't get caught)
============= SNIP ============
X-Spam-Status: No, hits=0.1 required=3.0
tests=HTML_MESSAGE
version=2.55
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
------------A40863880133651
Content-Type: multipart/alternative;
boundary="----------A95370304846963"
------------A95370304846963
Content-Type: text/plain;
Charset = "us-ascii"
Content-Transfer-Encoding: 7bit
------- cut html crap ---------
<td><p style="color:#FFFFFF; font-size: 1px;">
%RND_ALT%RND_ALT%RND_ALT
</p></td>
------- cut html crap ---------
------------A95370304846963
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
------- cut html crap ---------
<td><p style="color:#FFFFFF; font-size: 1px;">
%RND_ALT%RND_ALT%RND_ALT
</p></td>
------- cut html crap ---------
------------A95370304846963--
------------A40863880133651
Content-Type: image/gif; name="vicodinad.gif"
Content-Transfer-Encoding: base64
