Hi all,
Over the past couple of days I've been getting slammed with spams that
have subjects of the form:
Subject: <u...@host.com> spammy subject line
That is, the recipient's email address is included explicitly in angular
brackets at the beginning of the subject line. These are new and "varied"
enough that some are getting through the Bayes filter, and there aren't
enough other hits to auto-spam them yet.
I thought SA had rules about catching recipient email addresses in the
subject and/or body, but nothing appropriate is hitting on these spams and
I can't seem to find any appropriate rules in the main distribution. I
know this was discussed a few months ago, and I mentioned at that time
that whatever rule was being mentioned (which I have forgotten by now) did
not hit on recipient email addresses in the subject line.
Anyone have any idea which rules are supposed to hit for this, and why
they may not be working? At least for me and my users, basically no
legitimate email ever includes the email address in the subject line (body
yes, subject no).
Thanks.
--- Amir
