On 4/28/2017 7:56 AM, Vlad Mazek wrote:
We've been seeing a ton of spam with links using http/https links to
IP addresses instead of hostnames.
Has anyone else seen this pattern recently? If so, would you mind
sharing a rule to match these links in the body of the message?
-Vlad
Hi Vlad, look at KAM_BADIPHTTP in
https://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf
I believe it's along the lines of what you are asking.
Regards,
KAM
--
Kevin A. McGrail
Asst. Treasurer, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
