Ray Anderson wrote:
Wouldn't a better solution to be check the e-mail for NOT having any
alpha chars?
All numbers seems like a no-brainer to me, but I'm fairly new at this. :)
Something like
Body ~= /[^a-zA-A]/
?
Too many false positives with that one. You'd need to be sure you didn't
hit real short emails containing only numbers, like phone numbers,
passwords, etc..
The one below also FPs on the real outlook client.
The Date header seems to be a bit messed up.(space,tab,date)
Might look at that too. ;-)
Ken A
Pacific.Net
Cheers,
-=Ray
Justin Mason wrote:
this seems to catch them:
header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build
10\.0\.6626$/
header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\
V6\.00\.2900\.2962$/
meta JM_TORA_XM (__MAILER_OL_6626 && __MOLE_2962)
--j.
Billy Huddleston writes:
So, here is a question... Why spam everyone with TORA.08, I don't
even know what the heck that means!!!
----- Original Message ----- From: "Evan Platt"
<[EMAIL PROTECTED]>
To: <users@spamassassin.apache.org>
Sent: Friday, November 17, 2006 10:48 AM
Subject: Re: I've got TORA.08 spelled with numbers?
At 07:44 AM 11/17/2006, you wrote:
I'm getting a bunch of spams this morning that have
TORA.08 spelled out with numbers like this.
4216775 0611576 215556 7 3308011 3258576
6 7 5 1 5 3 8 5 2 7 3
8 3 6 5 0 4 1 2 7 0 5
7 2 2 257873 5 7 4 1 3387715
6 2 5 7 1 111500075 8 6 2 2
8 2 2 7 7 3 2 656 0 3 0 8
0 6430533 4 4 8 6 207 5412501 7637213
Does anybody know what this is about.
Got 2 also.
Wasn't there a stock image spam with TORA.TORA or something?
