Try my regex ( /[:;`(){}~#&"%$_][a-z][:;`(){}_~#&"%$]/im ) in a subject header check, and meta this with something like __HAS_ANY_URI and or SUBJ_ALL_CAPS.
You may also want to upper your scoring for URIBL rules. And train your bayesian filter with those spam messages. BAEYS_00 means they are considered hammy. If you do not train your baeysian filter, disable it at once (add "use_bayes 0" and "bayes_auto_learn 0" in your local.cf) These are only my opinions, I apologize for not being able to provide more support (busy day at work). Alex, from prypiat. Yes, I recycle. On 12-10-05 01:17 PM, Cathryn Mataga wrote: > Thanks for the comments. I'll see if I can cook something up here. > Someone asked to see the > actual messages. > > I collected 4 of these messages and put them at this link. > > http://www.mataga.net/mataga/spam.txt >