On Thu, 18 Mar 2010, Ned Slider wrote:
If that's not an option, how about a meta rule for FROM_YAHOO and
__HAS_ANY_URI (this rule exists in SA).
Lots of ham may contain a URI, but how much ham contains ONLY a URI?
Rough outline of rule, untested.....
rawbody __BODY_ONLY_URI
/^[^a-z]{0,10}(http:\/\/|www\.)(\w+\.)+(com|net|org|biz|cn|ru)\/?[^
]{0,20}[a-z]{0,10}$/msi
Combine that with 'frequent abusers' like Yahoo, and you've got something
you can give a few points....
There will probably need to be a variant on this to account for HTML mail
and/or the 'standard' footers inserted by free mail agents. Which
incidentally, suprises me here. I thought Yahoo always added a tagline?
- C
