"Yorkshire" == Yorkshire Dave <[EMAIL PROTECTED]> writes: Yorkshire> >> # Long-gone user listed in the To: or Cc: line >> header ANCIENT_RCPT ToCc =~ /(joeuser1|joeuser2|joeuser3)/i >> describe ANCIENT_RCPT LOCAL: Long-departed user ID in addressee list >> score ANCIENT_RCPT 4.0 Yorkshire> Yorkshire> I hope you'll bounce them for a few months first to give the Yorkshire> mailing lists a chance..
These people have been gone for about 5 years. I think that's long enough to wait. :-) Yorkshire> if you want something site specific AND effective, try Yorkshire> searching the bodies for mycompany.com ROT13'd or backwards Yorkshire> like moc.ynapmocym I just checked, and you're right. I see a lot of hits ROT13 hits. There seems to be a built-in BODY rule already checking for this, though: * 2.9 -- BODY: Message seems to contain obscured email address (rot13) I'm seeing some occurrences of it in the headers, too, though I don't see any mention of any header rule hits. As for the reversed domain name, I found none in 3 months worth of spam. Yorkshire> I have a few more if anybody really wants them :) Perhaps... Thanks for the followup. -- Mike Scheidler [EMAIL PROTECTED] ------------------------------------------------------- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
