Here are some rules I added to my local.cf that seem to be catching a few things.
#Seems to be a broken bulk mail program that puts some of the headers in the email body rawbody MESSAGEIDINBODY /^Message-Id: <.*\@message-Id>$/ describe MESSAGEIDINBODY Distictive Message ID in email body score MESSAGEIDINBODY 2.00 rawbody FEEDBACKFORM /result of your feedback form/i describe FEEDBACKFORM What do you mean you don't remember sending them your address score FEEDBACKFORM 1.5 rawbody DRUGSDRUGSDRUGS /(zyban|propecia|phentermine|xenical|meridia|retin-a)/i describe DRUGSDRUGSDRUGS Drugs are good from the internet score DRUGSDRUGSDRUGS 1.5 rawbody OLDENOUGHFORPORN /(must be 18|no minors|are under 18)/i describe OLDENOUGHFORPORN Gotta be 18 to go to the promised land score OLDENOUGHFORPORN 1.5 #this one will only work for me, but if it there, it is 100% GUARANTEED to be spam #not sure how to make a general case for this header KERRYSUBJECT Subject =~ /kerry_nice/ describe KERRYSUBJECT Personalized subject for Kerry based on email address score KERRYSUBJECT 4.00 __________________________________________________ Do You Yahoo!? Try FREE Yahoo! Mail - the world's greatest free email! http://mail.yahoo.com/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
