On Fri, 23 May 2014, Alex wrote:
On Thu, May 22, 2014 at 8:44 PM, John Hardin <jhar...@impsec.org> wrote:
On Thu, 22 May 2014, Karsten Bräckelmann wrote:
On Thu, 2014-05-22 at 15:49 -0400, James B. Byrne wrote:
rawbody RAW_BLANK_LINES_05 /(\r?\n){5,9}/i
Why is everyone trying to match empty lines these days? Must be spam I'm
missing out on. ;)
Heh. Something similar just plopped into my spam quarantine.
You might want to do this:
rawbody MANY_BLANK_LINES /(?:(?:<br>)?\r?\n){9}/mi
I tried this for a while in my corpus. Have you combined this into a meta?
I'm finding this matches far too much ham to even remotely be considered.
Was it the intention to only match fn's?
It was more to illustrate a possible variant. The {9} is probably *way*
too low for production use, and yes, it should probably be a subrule used
in metas rather than being directly scored.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Christian martyrs don't explode. -- Marisol
-----------------------------------------------------------------------
3 days until Memorial Day - honor those who sacrificed for our liberty
