Hello mairhtin,
Thursday, December 18, 2003, 12:09:40 PM, you wrote:
m> I am getting a new flood of spam that appears not to be even
m> selling anything, but merely trying to get through the filters.
m> Could they be trying to "learn" from this? I don't see how, but
m> someone suggested as much.
Several got through here today as well; never again.
They are selling something, though...
m> Here's a copy of the spam mail and headers :
>>Free Cable^ TV meniscus derby archery ...
They're selling a cable converter of some kind. URL in the HTML.
m> Can anyone suggest how to trap this shit so I don't see it?
Rules I've created trap for "Free Cable.{0,4}TV" in body,
specific URL from HTML, and also the X-Mailer.
Interesting that their Message-Id references @city or @country, each one
being different.
Might also be able to test on the orgIP in the X-Originating-IP header.
(Yes, they hit my copy of the backhair rules also, but my backhair scores
are lower because of ham hits, so I've had to target this spam in
additional ways.)
Bob Menschel
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
