On Wed, 2009-06-17 at 18:02 +0300, Ibrahim Harrani wrote: > http://pastebin.com/m6a027715 > http://pastebin.com/d2c94dba0 > http://pastebin.com/m21c9df0 > http://pastebin.com/m775253b7
These all have three things in common: - the MIME type of the image attachment doesn't match the attached image file. A rule for trapping that (image type mismatch) was published here recently. - all three have deliberate misspellings on the subject and text body. A discussion about this (bad teens) has just ended here. - one of the Received: headers says 'from unknown', but note that my domain host generates this, so its not an infallible mark of spam and should probably be scored low and used only as a component of meta rules Personally, I'd use small to moderate (0.5 - 1.5) scores for rules matching the first two points, add a meta rule to boost the score of both these rules fire, and ignore the third point because IME it is not a spam indicator, but of course ymmv. Martin
