> I am getting quite a few spams that even with most of the > sare rules are > sneaking in under 5 points. 4.7 - 4.9 > > one common thing I've noticed the last 2 days is 80% or so > are addressed > to more than one email address like this > [EMAIL PROTECTED], [EMAIL PROTECTED] > > the part before the @ is always the same as my email address. > > is there a rule set the can check for this and add .2 to the score > > ... hmm looking at them again - I don't think my surbl is > working they > all have geocities links in them. I'll check on that first.
SURBL doesn't really work well with geocities sites since geocities CAN contain real sites, not just spammer sites. However, in our environment, we only have one person (currently) sending real e-mail with a geocities link, so I simply whitelisted the person and use KAM's geocities rule to pretty much block the rest. You can find the rule here: http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf Caution: scoring the rule too high is subject to false positives. YMMV. Bret
