Greg Wright wrote: > Gday all. > > > > Can anyone tell me the best way to target spam arriving with the same > ‘From’ (and often ‘Subject’) field content, but coming from a new ip > with updated DNS/SPF etc. The only consistent thing about the emails is > that the From field (and subject) remains the same between sending hosts > for a week or more. > > > I could setup regex’s however the content changes over a week or more > (in some cases though, the same emails have been sent for months on end) > making regex trapping a very manual process. Something I am trying to > prevent, and additionally typically results in me getting lazy and using > less tringent matching and ending up with false positives…
If the Subject is remaining constant, then blackRe would work (or bombSubjectRe if you don't want to collect them), it will check the Subject, not just the body of the email. > Ive got scoring tuned so that they generally only get 1 message past > (per day/IP), and its usually marked as possibly spam, the remainder > then get blocked as scores increase, however I would love to find an > effective way to can these more effectively so that I don’t get an email > each day as their IP/DNS/SPF records all change. > With RBL enabled and the Penalty Box set to Message Scoring to catch the stragglers, none of these types of emails pass through for me. ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
