> -----Original Message-----
> From: Bram Mertens [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, March 09, 2004 2:31 PM
> To: spamassassin
> Subject: weird kind of spam
>
>
> Hi
>
> I received the following message, it's not really surprising SA didn't
> catch it: it's not empty but there's no content either...
>
> Is there any way to mark this as spam?
>
> --- spam message ---
*snip*
The following BLs list this IP:
DSBL/dsbl.org: 553 DSBL Multistage Relay; DSBL Unconfirmed [Remove]
NOMORE/moensted.dk: 553 NOMORE 2 - 1075639389 [Remove]
BLARS/block.blars.org: INET 127.1.0.9
So there is one way.
Or you could BL :
65.40/16 SPRINTDSL02 Winter Park, Florida :-)
or
header MY_WINTERPARK Received =~ /from
user\d{1,3}\.net\d{1,3}\.lv\.sprint-hsd.net/
or look at "helo=computer" that seems fishy! :)
or right a body rule to look for "<DIV> </DIV></BODY>" but I'm not sure
on its S/O.
Just some things to look at.
HTH,
--Chris
