I *believe* that this will catch them with a minimal amount of FPs. Running
with a low score for more tests and added to
www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf
#KAM NUMBER EMAILS
header __KAM_NUMBER1 Subject =~ /\d*/i
body __KAM_NUMBER2 /\d{1,6}/
meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2 +
MIME_HTML_ONLY + HTML_SHORT_LENGTH) >= 4)
describe KAM_NUMBER Silly Number Emails
score KAM_NUMBER 0.1
Regards,
KAM
I was just asked by a user about an email with a subject of 1545453 and a
body of 969. It has to be related.
This spam has been mentioned this morning, at http://isc.sans.org
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list [email protected]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
