See my reply in the thread "How are cllassified this?" for how to catch these in SA.
We're getting thousands of them here. Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -----Original Message----- > From: Gene Heskett [mailto:[EMAIL PROTECTED] > Sent: 03 April 2007 15:55 > To: users@spamassassin.apache.org > Subject: New spam method? > > Greetings; > > I seem to be attracting an unusual amount of little, less than 5 line > spams that basicly contain nothing but a link to a known spam image > server serving up a stock scam image. > > Unforch, the headers do not contain this name or address, and the > Received: from line that is common to all only contains a 3 letter > internet abbreviation. > > I've plugged that into procmailrc, but that seems a bit like using a > sledgehammer to kill a fly, with a potential for FP's being sent > to /dev/null. > > I don't see, in the procmailrc page, a method to do a wildcard on the > first section of a char.char.char address, which I think would be a > little more precise an aim at this particular offender. > > Anybody have any hints? > > -- > Cheers, Gene > "There are four boxes to be used in defense of liberty: > soap, ballot, jury, and ammo. Please use in that order." > -Ed Howdershelt (Author) > You have a strong appeal for members of your own sex. >
