On Tue, Jul 31, 2007 at 10:03:30AM +0200, Rocco Scappatura wrote: > It is possible to block the spam sent by GreetingCards.com which invites > the receiver to access an URL and browse the ecard? > > I mean that spam which has subject similar to: > > You've received a greeting ecard from a Colleague!
Here's my rule for it. header IGOR_POSTCARD_VIRUS Subject =~ /you\'ve received (a|an) (greeting (e)?card|ecard|postcard) from a\b/i score IGOR_POSTCARD_VIRUS 3 describe IGOR_POSTCARD_VIRUS PostCard virus
