On Dec 28, 2013, at 9:08 PM, John Hardin <jhar...@impsec.org> wrote: >> Yes, I definitely noticed that. As you can see from the spample (link >> below), none of the above rules are hitting properly; the To: line is a >> bare email, not properly angle-bracketed. Or, if any of the rules are >> hitting, the meta rule that they are supposed to trigger still does not >> trigger. >> >>> If you can post a spample or two somewhere I'll see what I can do. >> >> Spample: >> http://pastebin.com/0jEMBA1X > > Thanks, I'll take a look.
Just to note that I saw a bunch of hits on TO_IN_SUBJ today, when the To: was a bare email... I guess you've been working on this and pushed an update out? If so, it seems to be working nicely so far. > I'll have to check on that, I haven't looked in a while. My off-the-cuff > answer is: look in my sandbox and in the masscheck results, I expect it isn't > doing too well against the masscheck corpora. Just checking to see if you had a chance to investigate your HTML_COMMENT_GIBBERISH rule and whether it was working OK or not... Cheers. --- Amir
