At Thu Jan 15 08:49:37 2004, =?Windows-1252?Q?S=F6nke_Ruempler?= wrote:
>
> hi list,
>
> I wonder if i can to something against these spam messages:
I've picked out the following, which are common to other similar
messages I've seen:
> Content-Type: multipart/alternative;
> boundary="3285634181104916874"
The boundary is a long string of digits
> Message-Id: <[EMAIL PROTECTED]>
Message-ID is a short set of uppercase chars, hyphen, 3 zeros, more
digits, "at", string of lowercase chars.
> <TITLE>Message</TITLE>
Rawbody contains the text above
> <DIV><!-- Converted from text/plain format --><FONT face=Arial size=2>
Rawbody contains the text above.
I've added the following rules to my local.cf:
header L_MIME_BOUND_MANY_DIG Content-Type =~ /boundary=\"\d{19,}\"/
describe L_MIME_BOUND_MANY_DIG MIME boundary contains lots of digits
score L_MIME_BOUND_MANY_DIG 1.0
header L_MSGID_SPAM1 Message-Id =~ /<[EMAIL PROTECTED]>/
describe L_MSGID_SPAM1 Message-ID has known spammer pattern
score L_MSGID_SPAM1 1.0
rawbody L_TITLE_MESSAGE m{<TITLE>Message</TITLE>}
describe L_TITLE_MESSAGE Mail has an HMTL TITLE tag of "Message"
score L_TITLE_MESSAGE 1.0
rawbody L_CONVERTED m{<DIV><!-- Converted from text/plain format -->}
describe L_CONVERTED Converted from text/plain
score L_CONVERTED 1.0
Martin
--
Martin Radford | "Only wimps use tape backup: _real_
[EMAIL PROTECTED] | men just upload their important stuff -o)
Registered Linux user #9257 | on ftp and let the rest of the world /\\
- see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
