> -----Original Message----- > From: Kevin A. McGrail > Anyway, the current rule I believe is actually worth using is > this and more revisions might be made at > http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf > > #KAM NUMBER EMAILS > header __KAM_NUMBER1 Subject =~ /^\d+$/i > body __KAM_NUMBER2 /\d{1,6}/ > meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2 + > MIME_HTML_ONLY + HTML_SHORT_LENGTH) >= 4) > describe KAM_NUMBER Silly Number Emails > score KAM_NUMBER 0.1
A couple other things I've noticed: This spam always hits on FROM_AND_TO_SAME2 and header __NUMBER3 Message-ID =~ /\<[EMAIL PROTECTED]>/ (substitute your own domain for example.com). _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list [email protected] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
