> FWIW all three of those messages came from sources that are on multiple
> IP-based block-lists (DNSBLs) such as spamhaus.net, spamcop.net, &
> abuseat.org.
>
> If you were using those methods for filtering (either via postfix
> filtering or
> SA scoring) those messages shouldn't have made it th
Hi John,
> It would be better if you could post a few spamples to something like
> pastebin or a webserver you control and send the URLs to the list so
> that we can see the complete raw messages.
here are 3 examples:
http://sandberg.nl/sp/
1 and 2 have the pattern I described before,
3 is anot
thanks for your attention,
Jan-Kees van Kampen
I wrote:
> attachmentname.split($.)[1] == ".zip/.docx"
but I meant of course:
attachmentname.split($.).last == "zip" or "docx" ...
Sorry if i'm spamming the list ;)