The equal sign before A3 indicates that the message body was using quoted-printable transfer encoding. It sounds like the Content-Transfer-Encoding heading, which is where this is specified, got lost somewhere.
We have thought about adding a rule that if AB123435C "is Not" contained within the message body or attachment, You can probably do this with a negative assertion. For example if you add the following to the beginning of your existing regex:(?!AB123...
account number is \d+ Weight of 8account number is 123456 Weight of 1You can use the following line in your dictionary:account number is (?!123456)\d+This will match the phrase "account number is" followed by a number that is not "...
Is there a way to see in the logs what word or words was causing the content filter to fire?I have lookd some but culdn't find anything.ThanksRecent versions of AsyncOS (as of 5.5?) have a $MatchedContent variable. With a bcc you're limited to using...
I can say that one commonality I have found is the charset of all the messages that suffer the "subject truncation" fate is UTF-7. Thoughts?'+' is a special character in UTF-7, so if you changed your prefix to "[SPAM-Pos]" it would avoid the problem...