Hi, I'm having a real problem with this persistent spam that contains just a URL as the body, and is always from yahoo. I've got an example here:
http://pastebin.com/UqzhDHEu 'example.com' is my change. I'm using SA v3.2.5 with postfix/amavis. I'm concerned that the bayes score is always low. I can't determine any other patterns from this message to key on for other rules. Ideas most welcome. Thanks! Best, Alex