On Sun, 7 Dec 2003 00:28:31 -0600, Robert Nicholson <[EMAIL PROTECTED]> posted to spamassassin-talk: > I've got a mailbox full of messages that got past SA > They are all from the same spammer.
Hmm, not all of these have the Reply-to pattern which the followups were concentrating on. Here are the exceptions: > From: Harley Davidson <[EMAIL PROTECTED]> > Subject: Harley Davidson RC Motorcycles are here... > Date: December 6, 2003 3:21:26 PM CST > To: Robert David Nicholson <[EMAIL PROTECTED]> > > From: Smiles Coffee <[EMAIL PROTECTED]> > Subject: Try our Coffee - Get $70 in Complimentary Gifts > Date: December 6, 2003 10:58:32 AM CST > To: Robert David Nicholson <[EMAIL PROTECTED]> > > From: Loyalty Interactive <[EMAIL PROTECTED]> > Subject: Loyalty Interactive Homeowner News - December 2003 > Date: December 6, 2003 10:23:27 AM CST > To: Robert Nicholson <[EMAIL PROTECTED]> > Reply-To: Loyalty Interactive > <[EMAIL PROTECTED]> > > From: Universal Cable Box <[EMAIL PROTECTED]> > Subject: 100% Legal Digital Cable TV Descramblers > Date: December 6, 2003 6:53:34 AM CST > To: Robert David Nicholson <[EMAIL PROTECTED]> > > From: Credit Incentive <[EMAIL PROTECTED]> > Subject: "Unlimited Cash and Prizes with our MasterCard!" > Date: December 5, 2003 10:09:36 PM CST > To: Robert David Nicholson <[EMAIL PROTECTED]> > Reply-To: Credit Incentive <[EMAIL PROTECTED]> > > From: Homestore | Everything Home <[EMAIL PROTECTED]> > Subject: See the Latest Trends in Kids’ Rooms > Date: December 5, 2003 10:27:05 PM CST > To: Robert David Nicholson <[EMAIL PROTECTED]> > Reply-To: Homestore | Everything Home > <[EMAIL PROTECTED]> For many of these, one can observe that the "user name" in the From: header often also occurs in the Subject line. This could be a useful rule pattern, although there are bound to be false positives, so the score should be rather low. I don't know off-hand if there is a way to do this in SA currently. I'd guess it would take a specialized eval: rule. Maybe it's not worth the effort. /* era */ -- The email address era the contact information Just for kicks, imagine at iki dot fi is heavily link on my home page at what it's like to get spam filtered. If you <http://www.iki.fi/era/> 500 pieces of spam for want to reach me, see instead. each wanted message. ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
