> I got some spam today whith a low hit sent by the User-Agent: Rodriquezmail v9.8 > Google find some rules hiting Rodriquezmail at http://lagavulin.lacave.net/mailer/
If you just want to get rid of that, their rule header SPAMWARE_LACAVE_3 User-Agent =~ /Rodriquezmail|VXmainer/ describe SPAMWARE_LACAVE_3 SpamWares de la liste http://lagavulin.lacave.net/mailer score SPAMWARE_LACAVE_3 5 would seem to do it for you. It also is checking for "VXmainer", which I almost think is a typo and should have been "VXmailer". I suggest modifying the rule they give to something more like: header SPAMWARE_LACAVE_3 User-Agent =~ /Rodriquezmail/ describe SPAMWARE_LACAVE_3 SpamWares de la liste http://lagavulin.lacave.net/mailer score SPAMWARE_LACAVE_3 3 I dropped the score from 5 to 3 on the assumption that maybe that mail agent isn't pure spam, and real spam will probably also hit some other rules to tip it over the edge. Loren
