> > Got a couple spams today that slipped by SA with a plain text and HTML
> > part, and this was the plain text part:
> >
> > "Get a capable html e-mailer"
> >
> > Do you sense a certain frustration with us? ;)
>
> I sense a great string to filter on.
>
> I've seen this mentioned a couple of times recently. If it's really
> diagnostic of spamware - which it probably is - it might not hurt to write
> a rule for it.
You mean something like this? Works like a charm.
rawbody LW_INCAPABLE /^Get a capable html e-mailer$/
score LW_INCAPABLE 1
describe LW_INCAPABLE Wants you to read HTML spam
Loren
