----- Original Message ----- From: "Anthony Martinez" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, December 25, 2003 11:23 PM Subject: [SAtalk] X-Originating-IP isn't a number
> I got a spam today where the X-Originating-IP header wasn't a number. Hotmail > always puts the dotted quad in the header. > > > I wrote a rule to match this - I hope it's useful. > > header XORIG_IP_NOT_NUMBER X-Originating-IP !~ /\[[\d\.]*]/ > describe XORIG_IP_NOT_NUMBER The X-Originating-IP header is not a number > score XORIG_IP_NOT_NUMBER 0.4 > > Something about this causes it to hit on every message which does not contain a X-Originating-IP header. I think you need a meta test to check if that tag exists before checking if it *doesn't* contain that pattern. ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
