Kerry Nice just mooed:
>
> Here are some rules I added to my local.cf that seem
> to be catching a few things.
>
> #this one will only work for me, but if it there, it
> is 100% GUARANTEED to be spam
> #not sure how to make a general case for this
> header KERRYSUBJECT Subject =~ /kerry_nice/
> describe KERRYSUBJECT Personalized subject for
> Kerry based on email address
> score KERRYSUBJECT 4.00
You'll note my attribution line above; I match on "mooed"
and whitelist it. This generalizes pretty well - you can
put a little unique tag in your attribution line, subject,
or .signature (I favor a uniquely formatted attribution
line, myself) and whitelist the daylights out of it.
Another tactic I use is whitelisting common formats of
attribution lines. Spammers don't tend to quote messages back
at you, thank goodness. This would be easy for them to subvert,
but would also make their messages look strange.
body ATTRIBUTION /^(at|on) .* wrote:$/i
describe ATTRIBUTION BODY: quotes someone back
score ATTRIBUTION -1
(I like this one a lot, personally - it caught 4 legitimate
messages that made their way into my spam corpus).
-Dave
--
work: [EMAIL PROTECTED] me: [EMAIL PROTECTED]
MIT Laboratory for Computer Science http://www.angio.net/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
