> -----Original Message----- > From: Matt Kettler > Sent: Friday, October 24, 2003 6:32 PM > To: [EMAIL PROTECTED]; > [EMAIL PROTECTED] > Subject: Re: [SAtalk] Whitelist / Rule Question... > > > At 01:34 PM 10/24/2003, Dan Tappin wrote: > >rawbody USERNAME /username/i > >describe USERNAME > >score USERNAME -100.0 > > > >... where the person sending e-mail is [EMAIL PROTECTED] > > Um... does "username" appear in the body part of the message? > Note that > "rawbody" does not include the headers. > > You probably want > header USERNAME ALL =~ /username/i > > That is, provided that the normal whitelisting methods don't > work for you: > > whitelist_from [EMAIL PROTECTED] > > (you said you weren't worried about falses, otherwise I'd recommend > whitelist_from_rcvd)
I get username in the body also. While trying to personalize a message the spammer uses an alias/username for an introduction. An example would be a person with an address of [EMAIL PROTECTED] #--- Begin Example ---# Hello Dude, We are looking for people with blah blah blah . . . #--- End Example ---# The problem may be obfuscation. #--- Begin Example ---# H<!-- junk -->ello Dude,<Br><BR>We are loo<!-- more junk -->king #--- End Example ---# --Larry ------------------------------------------------------- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Source Community? Make a contribution, and help us add new features and functionality. Click here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
