[SAtalk] Sender addresses like someone_xx@somewhere.tld

[MI]

Recently, I've seen *lots* of sender addresses where the user part ends 
with an underscore followed by 2 (possibly random) lower case letters. I 
mainly see these in RBL reject logs, and have also seen a few in spam that 
passed through.

A few examples from yesterday's logs:

  <[EMAIL PROTECTED]>
  <[EMAIL PROTECTED]>
  <[EMAIL PROTECTED]>
  <[EMAIL PROTECTED]>
  <[EMAIL PROTECTED]>
  <[EMAIL PROTECTED]>
Is anybody aware of some spam tool generating such adresses?
Do you know of valid addresses like these?
I'm considering adding something like this:

  header LOCAL_FROM_WITH__xx From =~ /_[a-z]{2}\@/
  score LOCAL_FROM_WITH__xx 0.2
  describe LOCAL_FROM_WITH__xx From: address has user part ending in _xx@
What do you think?



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk