On Tue, Feb 12, 2002 at 02:56:25PM -0800, Craig Hughes wrote: > We could add a negative > > header OUTLOOK_EXPRESS /Microsoft Outlook Express/ > describe OUTLOOK_EXPRESS Spammers use real software > score OUTLOOK_EXPRESS -3.0 > > Something like that?
Sounded great to me, until I checked my caught spam... From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Is your company looking for capital X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2462.0000 Importance: Normal X-Spam-Status: Yes, hits=19.6 required=5.0 tests=NO_REAL_NAME,FROM_ENDS_IN_NUMS,PARA_A_2_C_OF_1618,EXCUSE_3,EXCUSE_7,SECTION_301,SENT_IN_COMPLIANCE,JAVASCRIPT,SLIGHTLY_UNSAFE_JAVASCRIPT,MAILTO_LINK,MAILTO_WITH_SUBJ,FORM_W_MAILTO_ACTION,MURKOWSKI_CRUFT,MAILTO_WITH_SUBJ_REMOVE,FREQ_SPAM_PHRASE,CTYPE_JUST_HTML,FORGED_YAHOO_RCVD version=2.01 (And some that don't score quite so high.) Leave it to MS to mess things up... Here's what I did: header OE_UNDISC_RECIPS To =~ /\<Undisclosed-Recipient:\@.*;\>$/ describe OE_UNDISC_RECIPS Valid-looking Outlook Express style To "undisclosed-recipients" score OE_UNDISC_RECIPS -3.0 What do people think of that? Dan. _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
