Hi Everyone,
I have tested samfilter for a while and very happy with how it works. however, have a question hoping someone has an answer willing to share.

I have a Keyword RegEx filter that looks for numeric IP numbers in each inbound message:

((?i)http://+([\d]{1,3}[\.+]){3}[\d]{1,3})

a while back Barracuda spamfilter started to add IP-numbers to message header area - something like this ...

X-Barracuda-Connect: www1.ethostream.com[66.195.129.11]
X-Barracuda-URL: http://66.195.129.15:8000/cgi-bin/mark.cgi
X-Barracuda-Virus-Scanned: by Barracuda Spam Firewall at ethostream.com

Now, spamfilterISP generates more false positives when sender is using Barracuda. My question is:

Is there any directive that i can apply to my RegEx filter so filter scans only body of message (and ignore message header)? Please let us know.

Thank you.


Edited by microtech - 19 February 2010 at 7:54pm