Mike, As I mentioned in another thread (null bodies), I used the following rule with approx 1% of false positive.
H!~From\:!OR!H!~Subject\::[EMAIL PROTECTED] The only false positives I got were local users sending from their yahoo or hotmail accounts and not putting a subject. I simply advised all my users to put a subject when sending mail from outside addresses. Hope this helps (anyways it's the only way I was able to get rid of them!) Thanks gd -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, May 27, 2004 4:22 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Blank Messages (Null Messages) >What can you do to prevent stuff like this? Also, if you make a rule, etc is >there any possibility of false positives? I'd like a rule that sends it to >the spam mailbox. > > >Received: from wbar9.lax1-4-11-200-006.dsl-verizon.net [4.11.200.6] by >mail.websiteworld.com > (SMTPD32-8.05) id A3EE65011A; Thu, 27 May 2004 03:08:30 -0400 >Received: from 222.46.176.18 by 4.11.200.6; Thu, 27 May 2004 13:09:23 +0500 >Message-ID: <R[20 >X-UIDL: 348014836 If you're just looking for a rule (as opposed to anti-spam software detecting it automatically), you could try an IMail filter that looks for "Message-ID: <" followed by any characters and then "[". That will catch this specific spammer, and should have very few (if any) false positives. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
