On 15-Feb-2010, at 14:41, Aggelos wrote: > > Return-Path: <steven_m_cr...@hotmail.com> > X-Original-To: <u...@my.domain.org> > Delivered-To: <u...@my.domain.org> > Received: from blu0-omc1-s16.blu0.hotmail.com > (blu0-omc1-s16.blu0.hotmail.com [65.55.116.27]) > by <mysmpt.my.domain.org> (Postfix) with ESMTP id 33C04FB9D > for <u...@my.domain.org>; Mon, 15 Feb 2010 12:14:49 +0200 (EET) > Received: from BLU0-SMTP25 ([65.55.116.9]) by > blu0-omc1-s16.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); > Mon, 15 Feb 2010 02:14:46 -0800 > X-Originating-IP: [222.69.163.146] > X-Originating-Email: [steven_m_cr...@hotmail.com] > Message-ID: <blu0-smtp25c0ae687aa29c4655d059c7...@phx.gbl> > Received: from zjg ([222.69.163.146]) by BLU0-SMTP25.blu0.hotmail.com > over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); > Mon, 15 Feb 2010 02:14:45 -0800 > Reply-To: <wowaccountad...@admin-blizzard.com> > Date: Mon, 15 Feb 2010 06:18:19 +0800 > From: "wowaccountadmin" <wowaccountad...@blizzard.com>
Just as a unrelated point, forward these messages (as attachments or at least with complete headers) to ha...@blizzard.com. They DO go after these sites. I've fed a couple of dozen to bayes and they no longer get through. You could also do something like uri URI_BLIZZARD /\bblizzard\.com\b/i mimeheader MH_BLIZZARD Content-Transfer-Encoding: base64 meta SPOOF_BLIZZARD (URI_BLIZZARD && MH_BLIZZARD) score SPOOF_BLIZZARD 1.0 (untested, but something like that) -- 'Oook?' 'I like to listen to a man who likes to talk! Whoops! Sawdust and treacle! Put that in your herring and smoke it!' 'I don't think he wants one,' said Ponder. --Lords and Ladies
