I have received a spam that scored 9.9 on my system. The subject of the email was: "You could WIN A PLASMA TV" The content was mostly a large GIF image and some HTML. When I examine the rules that were triggered, I was surprised that none was triggered for the fact that the header told me I was a winner or potential winner... In previous occasions I've seen a similar rule triggered when such text was found in the body of a message. Indeed it was also in the body of the message but as part of the GIF image...
Shouldn't this simple header rule be part of the core rules that are distributed with SA? --ilan
