Quoting Jason Little <[EMAIL PROTECTED]>: > I just wrote my own rule > Called it wrotesub.cf > > header LR_WROTE_SUB Subject =~ /\bwrote\b\:/i > describe LR_WROTE_SUB Wrote in Subject > score LR_WROTE_SUB 3.0
Hmm the 'wrote' spams we get are more like /\bwrote:\b/i > > Jason Little > Network Admin > Mint Inc > -----Original Message----- > From: John D. Hardin [mailto:[EMAIL PROTECTED] > Sent: Tuesday, November 28, 2006 10:25 AM > To: Jonathan Nichols > Cc: users@spamassassin.apache.org > Subject: Re: Loads of 'xxx wrote:' Spam > > On Mon, 27 Nov 2006, Jonathan Nichols wrote: > > > I ran sa-update earlier, have URIBL, razor, etc.. and I'm still > > getting these slipping through. > > > > It's tempting to add +3 to "wrote:" in the subject. > > Do you happen to be using the SARE stocks ruleset? If not, I recommend doing > so. > > -- > John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > ----------------------------------------------------------------------- > "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never > does quite what I want. I wish Christopher Robin was here." > -- Peter da Silva in a.s.r > ----------------------------------------------------------------------- > 27 days until Christmas > > >
