lots of freemail spam

[Lawrence @ Rogers]

Hi,

Lately, I notice we are getting a fair amount (10-12 per day per client) 
of spam coming from freemail users (FREEMAIL_FROM triggers). Usually the 
Subject is non-existent or empty, and the message is always just an URL

Is there a good rule for flagging these as possible spam? I understand 
that there may be some legit e-mails that would hit all 3 factors, so I 
would score the rule low.

Thoughts?

Regards,
Lawrence