Gday all.
Can anyone tell me the best way to target spam arriving with the same
'From' (and often 'Subject') field content, but coming from a new ip
with updated DNS/SPF etc. The only consistent thing about the emails is
that the From field (and subject) remains the same between sending hosts
for a week or more.
I could setup regex's however the content changes over a week or more
(in some cases though, the same emails have been sent for months on end)
making regex trapping a very manual process. Something I am trying to
prevent, and additionally typically results in me getting lazy and using
less tringent matching and ending up with false positives...
Ive got scoring tuned so that they generally only get 1 message past
(per day/IP), and its usually marked as possibly spam, the remainder
then get blocked as scores increase, however I would love to find an
effective way to can these more effectively so that I don't get an email
each day as their IP/DNS/SPF records all change.
Examples:
From: Subject:
Coupon Book Savings $10 off the 2008 Entertainment book
4 seasons Enjoy the Holidays with great wines
delivered straight to your door.
Etc...
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
