IF your mails have that kind of subject too, yes, but is malformed:
header ICAB_FW2 Subject =~ /^Fw:\s\d{1,9}$/i
score ICAB_FW2 4
describe ICAB_FW2 IMAGE SPAM
("ICAB" is related to my work, feel free to change it)
Ruben.
> -----Mensaje original-----
> De: Joey [mailto:[EMAIL PROTECTED]
> Enviado el: viernes, 24 de febrero de 2006 19:06
> Para: 'Ruben Cardenal'; users@spamassassin.apache.org
> Asunto: RE: GIF stock spams
>
> Sorry wasn't thinking, should this work?
>
>
> header ICAB_FW2 Subject =~ /^Fw:\s\d{1,9}$/i score ICAB_FW2 1
> score ICAB_FW2 4
> describe ICAB_FW2 IMAGE SPAM
>
>
> -----Original Message-----
> From: Ruben Cardenal [mailto:[EMAIL PROTECTED]
> Sent: Friday, February 24, 2006 1:02 PM
> To: users@spamassassin.apache.org
> Subject: RE: GIF stock spams
>
>
> Hi Joel,
>
> Well, I have spamassassin scoring as spam from 3.0 on, and until 14 gets
> quarantined for review for messages not scoring BAYES_99. Almost 250.000
> messages scoring over 14 with only 1 FP being rejected (and was quite an
> unusual situation).
>
> That kind of mails have all "Fw: 12345", from 3-6/7 numers. Writing a
> rule
> to score those subjects could help, but don't score it too high or you'll
> catch innocent mails. You have the rule I used in my firs mail. I
> quarantine
> mails using excellent Toribio's Qmail-Scanner patch (you can find it at
> http://toribio.apollinare.org/qmail-scanner/) That kind of funcinality has
> been added in the Qmail-Scanner 2.00 RC1 .
>
> Good luck,
>
> Ruben
>
> > -----Mensaje original-----
> > De: Joey [mailto:[EMAIL PROTECTED]
> > Enviado el: viernes, 24 de febrero de 2006 18:47
> > Para: users@spamassassin.apache.org
> > Asunto: RE: GIF stock spams
> >
> >
> > Hi Ruben,
> >
> > Sorry to be such a nube, but can you tell me exactly what I need to do
> > to impliment what is working for you.
> > These damn image files are killing us.
> >
> > Thanks,
> >
> > Joey
> >
> > -----Original Message-----
> > From: Ruben Cardenal [mailto:[EMAIL PROTECTED]
> > Sent: Friday, February 24, 2006 11:45 AM
> > To: users@spamassassin.apache.org
> > Subject: RE: GIF stock spams
> >
> > I catch them all, for example:
> >
> > X-Spam-Report:
> > * 1.0 ICAB_FW2 ICAB_FW2
> > * 1.1 EXTRA_MPART_TYPE Header has extraneous
> > Content-type:...type= entry
> > * 1.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes
> > of words
> > * 0.0 HTML_MESSAGE BODY: HTML included in message
> > * 6.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> >
> > header ICAB_FW2 Subject =~ /^Fw:\s\d{1,9}$/i score ICAB_FW2 1
> >
> > Ruben
> >
> >
> > > -----Mensaje original-----
> > > De: Chris Conn [mailto:[EMAIL PROTECTED] Enviado el: viernes, 24 de
> > > febrero de 2006 17:35
> > > Para: users@spamassassin.apache.org
> > > Asunto: GIF stock spams
> > >
> > > Hello,
> > >
> > > Has anyone written any rules to catch the following types of spam
> > >
> > >
> > > http://nisk.creenet.com/~cconn/sa/
> > >
> > >
> > > They consist of a few lines of text (sometimes), and a .gif
> > > attachment that is in fact some penny stock being pushed.
> > >
> > > Thanks in advance,
> > >
> > > Chris
> >
> >
>
>
>
