Hi,
Thank you Loren Wilton. I think this is best solution for me.
These are not from Kohl's or any other legitimate company. The
subject changes from month to month and the percentages change but
the format remains the same for the subject line. The body uses
legitimate text taken from various webpages and have phishing link
which also varies. The sender is "me" but the Return-Path is the
same name at different domain.
I tried to attach the message but apache.org rejected it.
Thank you,
Frank
I'm get alot of these February 77% OFF or variations (ie January
73% OFF and my guess March 75% OFF next month) thereof in the
subject line for spam. The body always changes so I can't really
key on this. I would like to make rule that subject line filter
this type of spam.
I have never seen one of these, so just going from your description
I can write a rule. Whether it will match your actual spam (which I
havne't seen) I can't say.
header MO_PERCENT_OFF Subject =~
/(?:January|February|March|April|May)\s+\d\d\%\s+OFF\b/i
The above will cover you for about the first half of the year, add
more months as necessary.
Loren
