Use the From:name check. Example: header BAD_NAME From:name =~ /(Penny Auctions|\bFree\b|\bCialis\b|\bViagra)/i score BAD_NAME 5.0
Use caution, as always. Mind your regexes. For instance, in this example, heaven forbid a user named Joe Viagraola sends an Email, blah, blah, blah. Regards, Jared Hall General Telecom, LLC. wvpTV wrote: > We've seen a recent explosion in spam that SpamAssassin does not flag, it > seems mainly because the FROM (sender) field is being used for subject > content, eg: VIAGRA, PORN etc etc > > Can anyone tell me how far off a standard filter update might be to carry > out checks on the FROM field? > > Thanks. > >
