So with this - > >Subject: News Alert > > > >--=_469e734c3adb39df03c2f293185d8c73 > >Content-Type: text/html; charset="ISO-8859-1" > >Content-Transfer-Encoding: quoted-printable > > > ><Table><tr><td>This is a spam</td></tr></table> > >
I would need to do the following if I was looking for <table at the beginning of a message BODY 15 CONTAINS Content-Transfer-Encoding: quoted-printable<Table This assumes the CRLF codes are striped instead of replaced. Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Matt > Sent: Monday, December 12, 2005 1:37 PM > To: [email protected] > Subject: Re: [Declude.JunkMail] Question about filtering > > > I believe it starts immediately following the first double CFLF. I'm > not sure if the STARTSWITH filter for BODY is tweaked in any way, but if > it is it only ignores CRLF's and not other characters. > > Matt > > > > Kevin Bilbee wrote: > > >I have a problem I have been trying to solve. When a contains > filter comairs > >abainst the body of the email where does that body begin? Does > it begin at > >the mime segment or does it begin at actual content? > > > >For example If I have something like this > > > >Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com > > (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800 > >Received: from I295e.i.pppool.de ([85.73.41.94]) > > by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674 > > for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800 > >Received: from [192.168.207.41] (port=4196 helo=parents) > > by I295e.i.pppool.de with esmtp > > id 7511378754121 > > for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100 > >MIME-Version: 1.0 > >Content-Type: multipart/related; > > boundary="=_469e734c3adb39df03c2f293185d8c73" > >Message-Id: <[EMAIL PROTECTED]> > >Date: Mon, 12 Dec 2005 21:18:36 +0100 > >To: <[EMAIL PROTECTED]> > >From: Jayme Dominguez <[EMAIL PROTECTED]> > >Subject: News Alert > > > >--=_469e734c3adb39df03c2f293185d8c73 > >Content-Type: text/html; charset="ISO-8859-1" > >Content-Transfer-Encoding: quoted-printable > > > ><Table><tr><td>This is a spam</td></tr></table> > > > > > >Does the body scanning start at --= or does it start at <Table > > > >Kevin Bilbee > >Network Administrator > >Standard Abrasives, Inc. > >[EMAIL PROTECTED] > >(805) 520-5800 x7332 > >____________________________________ > >Changing the way industry works. > > > >--- > >[This E-mail scanned for viruses by Declude Virus] > > > >--- > >[This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > > > > > > > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
