Dennis Hardy a écrit :
>> Is this spam for snowshoes or some "spam term"?
>
> "Like a snowshoe spreads the load of a traveler across a wide area of snow,
> some spammers use many frequently-changing IP addresses and domains to
> spread out the spam load in order to dilute recipient reputation metrics and
> evade filters."
>
> see http://www.spamhaus.org/faq/answers.lasso?section=Glossary#233
>
>> If the former, put some example up on a pastebin (not ehre!).
>
> Yes already done: http://pastebin.com/m4400a74d
you need to show full headers. there are generally patterns in the
envelope sender and in few headers.
Also, consider using BRBL:
header RCVD_IN_BRBL eval:check_rbl('brbl-lastexternal',
'bb.barracudacentral.org.')
describe RCVD_IN_BRBL Received via a relay in Barracuda BRBL
tflags RCVD_IN_BRBL net
score RCVD_IN_BRBL 3.0
adjust the score of course.
