I agree I really do not want to do a hold unless I used it with Gauntlet, but even then.
I have the test in place now and next week will run the logs and see how many times if any it made a difference, good or bad. -----Original Message----- From: "Markus Gufler | Limitis" <markus.guf...@limitis.com> Sent: Tuesday, November 17, 2015 11:45pm To: community@mailsbestfriend.com Subject: [MBF] AW: Test for short small HTML body with a URL in it I would recommend using it only in combination with at least one other indicator. A lot of people sends simple links without any greetings, explanations or other blabla. It would be an idea to keep such messages in a temporary queue and count the messages with different recipients and the same hostname in the link after one hour. If you see more than xx it could be hold as spam. If not forward it to the recipient. The problem in this special case is that the typical situation "two people talking on phone and one sends a message containing the link to..." is not compatible with such a temporary hold folder. One of them will call your support ... greetings Markus -----Ursprüngliche Nachricht----- Von: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] Im Auftrag von John Tolmachoff Gesendet: Dienstag, 17. November 2015 19:25 An: community@mailsbestfriend.com Betreff: [MBF] Test for short small HTML body with a URL in it I am seeing obvious spam emails getting through because the HTML body is very small and with a single link. It is that link that is the spam or malicious site, not the email itself. So I am thinking of creating a filter test that would END if it fails MSGSIZE-56KB. It would then have one line: BODY 10 CONTAINS href="http:// Any comments or suggestions? John T eServices For You ############################################################# This message is sent to you because you are subscribed to the mailing list <community@mailsbestfriend.com>. To unsubscribe, E-mail to: <community-...@mailsbestfriend.com> To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com> To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com> Send administrative queries to <community-requ...@mailsbestfriend.com> ############################################################# This message is sent to you because you are subscribed to the mailing list <community@mailsbestfriend.com>. To unsubscribe, E-mail to: <community-...@mailsbestfriend.com> To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com> To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com> Send administrative queries to <community-requ...@mailsbestfriend.com> ############################################################# This message is sent to you because you are subscribed to the mailing list <community@mailsbestfriend.com>. To unsubscribe, E-mail to: <community-...@mailsbestfriend.com> To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com> To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com> Send administrative queries to <community-requ...@mailsbestfriend.com>
