Write your own:
header LR_WROTE_SUB Subject =~ /\bwrote\b\:/i
describe LR_WROTE_SUB Wrote in Subject
score LR_WROTE_SUB 3.0
Thanks for the members that made them earlier.
I just repeat them because they do a nice job at my webserver:
body LR_CSAIL_EVERGLORY /Ever-Glory International/i
describe LR_CSAIL_EVERGLORY Ever-Glory International
score LR_CSAIL_EVERGLORY 1.5
body LR_CSAIL_EGLY_TICKER /\(EGLY\)/
describe LR_CSAIL_EGLY_TICKER Ever-Glory International
stock symbol
score LR_CSAIL_EGLY_TICKER 1.5
body LR_CSAIL_EVERGLORY_DISNEY /Ever-Glory and Disney/
describe LR_CSAIL_EVERGLORY_DISNEY Bogus Ever-Glory press
release
score LR_CSAIL_EVERGLORY_DISNEY 2.5
header __CSAIL_EGLY_SUBJ Subject =~ /^\S+ here\s+:\)/
meta LR_CSAIL_EGLY_SPAM ( __CSAIL_EGLY_SUBJ &&
LR_CSAIL_EGLY_TICKER )
describe LR_CSAIL_EGLY_SPAM This message really
looks like a recent EGLY pump & dump scam
score LR_CSAIL_EGLY_SPAM 5.0
Jason Little wrote:
We just started getting a ton of these. Is there an SA ruleset that I can
grab or do I just have to write my own.
Jason
-----Original Message-----
From: Loren Wilton [mailto:[EMAIL PROTECTED]
Sent: Wednesday, November 08, 2006 3:26 PM
To: users@spamassassin.apache.org
Subject: Re: Block "wrote:" spams
One thing I've noticed is the envelope return path... Watching this
morning, they all seem to be from 'debora<something>@<random.domain>'
debora wrote: in subject at the same time ?
No. (Finally got my first one of these.)
Loren
