score FAILNOTE 2
# blarson 2007-06-28
-rawbody CTINLINE /^Content\-Disposition\: inline\;\b/
+full CTINLINE /^Content\-Disposition\: inline\;\b/
describe CTINLINE Inline attachment
score CTINLINE 1
score TINYFONT 3
# blarson 2008-04-03
-rawbody ZIPFILE /\bfilename\=.*\.zip\b/i
+full ZIPFILE /\bfilename\=.*\.zip\b/i
describe ZIPFILE zipfile attachment
score ZIPFILE 0.5
describe CTOCTET_STREAM Content type is octet-stream
score CTOCTET_STREAM 0.5
-header RTF_ATTACH Content-Type =~ /name=.+\.rtf/i
-describe RTF_ATTACH Contains an RTF Attachment
-score RTF_ATTACH 0.5
+full RTF_ATTACH /^Content-Disposition:.+name=.+\.(rtf|doc)/i
+describe RTF_ATTACH Contains an RTF or DOC Attachment
+score RTF_ATTACH 2
meta RTF_SPAM CTOCTET_STREAM && RTF_ATTACH
describe RTF_SPAM Content type is octet-stream and has an RTF Attachment
describe COMPTESFR concernant Compte SFR
score COMPTESFR 3
+# formorer 2012-02-02
+header BACKTOME subject =~ /Please get back to me/i
+describe BACKTOME Phrase get back to me
+score BACKTOME 4