Hi, On Mon, Mar 5, 2018 at 3:14 PM, David Jones <djo...@ena.com> wrote: > FYI This could be something for KAM.cf potentially... > > I have seen a few of these this morning that would be scoring just under the > default SA threshold of 5.0 and are just under my MailScanner 6.0 threshold. > > https://pastebin.com/r2eZJaef > > I am reporting these to Spamcop but new waves of compromised accounts keep > sending them. > > They all seem to have a From address with two periods on the left side so > something like this: > > header __ODD_FROM_SPAM From:addr =~ /.{1,20}\..{1,20}\..{1,20}@/ > > could be combined with something else in a meta to help detect these and > push them over the edge.
https://www.mail-archive.com/users@spamassassin.apache.org/msg101391.html
