I too have seen these, Use the following rule, it works for me: header __FVGT_h_XNUMBER0 ALL =~ /x-transfer-number/ header __FVGT_h_XNUMBER1 ALL =~ /X-transfer-number/ header __FVGT_h_XNUMBER2 ALL =~ /X-TRANSFER-NUMBER/ header __FVGT_h_XSTAMP0 ALL =~ /x-transfer-stamp/ header __FVGT_h_XSTAMP1 ALL =~ /X-Transfer-Stamp/ header __FVGT_h_XSTAMP2 ALL =~ /X-TRANSFER-STAMP/ meta FVGT_h_XCRAP ((__FVGT_h_XNUMBER0 + __FVGT_h_XNUMBER1 + __FVGT_h_XNUMBER2 + __FVGT_h_XSTAMP0 + __FVGT_h_XSTAMP1 + __FVGT_h_XSTAMP2) > 3) describe FVGT_h_XCRAP FVGT - contains multiple X-transfer headings score FVGT_h_XCRAP 4.3
Frederic Tarasevicius Internet Information Services, Inc. David Watson wrote: > Our site has just received a spam with approx 19kb of headers of the > form shown at the end. > > The message gets marked as spam but the MUA (tested outlook and > Eudora) fails to filter based on the mark (presumably it gives up > scaning the headers before reaching my spam flag at the end). Clearly > subject rewriting or safe reporting would help in a situation like > this, but I thought it was worth a mention. > > x-transfer-stamp: UGUDWWQVNDJUYAQYKU > x-transfer-stamp: > -JBAA.LBTEDDHXFOWRO$MGGIJCNEVHYK+YBWEPRJCMBVAQWXNV+DXMJMPDQMFFBNHEMT$FVDHJ OB > UQS-CBKHJPWU-W+KXUQCLKEKE$+SQIBVGKVKWUGDQ+EDUHQ > Message-Id: <[EMAIL PROTECTED]> > x-transfer-stamp: 53uo0wAbS68x30bw5 > X-TRANSFER-STAMP: RJFUBUHLCFGAWTTQSYL > x-transfer-number: > 9.13984402-92154192413173+43242787$357948.2140496_717854551565524 > X-TRANSFER-NUMBER: > 3443084615625$1-$88+5769_7518559337109549.0939776960567-971.76734606180617.6 > 403+7273031.993+603859444115 > X-transfer-stamp: urouvsyfjbkaknff > X-transfer-stamp: > OHONYYJTMFTCH-AOARK+FGLDPX_KRPNXJMA+FYADJRHRBE+MBMXQYOTJWNIV_AKUIKYWUAAJVHUW > VB-AFTDEIQ_DBHCQUBDSAMCNGS.ESFDLKWH+IXNFKEFCVCRA$WKJMVSP_EYKEYQ-YDHE.PGKCXKU > NMK+MJEBTYVVIJHH$QFTFJODTMHCAJRXL.HDKY- > x-transfer-stamp: 8e2w1s56DF8j9Yp > Subject: You Won > x-transfer-number: > 85756783993213_149971930539169$3612967250829.0125621991071$4113248267.9875-3 > 3675616326$870_775026_2302760772218066568.10537539279959318$6522454297531536 > 193+06258676757205831$196790516686399199 > X-TRANSFER-STAMP: DIKO5JMw2cYv9LBe4i6 > X-transfer-stamp: XSJOPQPKDANBPKOWGRR > X-transfer-number: 6959198967956415 > _____________________________________________________________ > David Watson, Network Manager, Team17 Software Ltd. > Phone: +44-1924-267776 Fax: +44-1924-267658 > _____________________________________________________________ > > > > ------------------------------------------------------- > This SF.net email sponsored by: Enterprise Linux Forum Conference & > Expo The Event For Linux Datacenter Solutions & Strategies in The > Enterprise Linux in the Boardroom; in the Front Office; & in the > Server Room http://www.enterpriselinuxforum.com > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo The Event For Linux Datacenter Solutions & Strategies in The Enterprise Linux in the Boardroom; in the Front Office; & in the Server Room http://www.enterpriselinuxforum.com _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
