Hello! I'm seeing some spam with bogus-looking 'yahoo' message-ID's. Could someone please test this rule against a nice large corpus?
header LOC_BADYAHOOMSGID Message-ID =~ /[EMAIL PROTECTED]/i
If that one matches ham, please try the more-specific version below:
header LOC_BADYAHOOMSGID Message-ID =~ /[A-Z]{8,[EMAIL PROTECTED]/
I have deliberately left off the 'i' (case insensitive) switch in
this rule.
Thanks!
- Charles
