On Mon, 21 Jun 2004 23:28:04 -0400 "Clay Irving" <[EMAIL PROTECTED]> wrote:
> I've never seen legitimate mail using this MUA: > User-Agent: MOMENTUM (3.0 build(25) [Asynch]) its a known spammer tool. > It looks like a good rule to me: > header CI_MOMENTUM User-Agent =~ /MOMENTUM \(3\.0 build\(25\) > \[Asynch\]\)/ > describe CI_MOMENTUM MOMENTUM MUA > score CI_MOMENTUM 2.0 I'd use: header CI_MOMENTUM User-Agent =~ /MOMENTUM/i so as to avoid changes in the version number, and case sensitivity.
