On May 22, 2014, at 6:44 PM, John Hardin <jhar...@impsec.org> wrote: > > You might want to do this: > > rawbody MANY_BLANK_LINES /(?:(?:<br>)?\r?\n){9}/mi
AC_BR_BONANZA should cover the HTML case. It could be easily extended to match standard LF or CR per above. (In my case I am matching something like 20 newlines for the HTML case, to try to prevent FPs.) --- Amir thumbed via iPhone