Hi Martin,
May be you could try something like this, but change the English text into Norwegian accordingly. describe J_MAILBOX_FULL Your mailbox has exceeded spam body J_MAILBOX_FULL /^Your? ((web|E-?) ?mail|mailbox) .*(is|has) .*(exceed|over)/i score J_MAILBOX_FULL 1.0 --- "I decided that I was a lemon for a couple of weeks. I kept myself amused all that time jumping in and out of a gin and tonic." simon@klunky .co.uk / .org On 2013-05-02 12:45, Martin Gregorie wrote: > The last two days I've started to get a small amount of spam with these > characteristics: > - its of the "you've exceeded your 2GB mailbox size. Click <URL> to > revalidate your account" variety > > - sender has a Hispanic name and (so far) has been sending the mail from > a Spanish-speaking country which is the TLD in both the sender URI > and message ID > > - the body text is recognised as Norwegian by Babelfish > > - the target URL is a website hosted by webs.com > > Is anybody else seeing this? > > Is webs.com generally known for hosting spam-related websites? I have > only one other occurrence of it in my spam collection of 835 messages. > > Martin
