I got a spam today where the X-Originating-IP header wasn't a number. Hotmail
always puts the dotted quad in the header.


I wrote a rule to match this - I hope it's useful.

header XORIG_IP_NOT_NUMBER      X-Originating-IP !~ /\[[\d\.]*]/
describe XORIG_IP_NOT_NUMBER    The X-Originating-IP header is not a number
score XORIG_IP_NOT_NUMBER       0.4



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to