> header FROM_STARTS_WITH_NUMS From:addr =~ /^\d{6,}\S+\@/i
> The email address used in the From header begins with 6 (or more)
> digits. it's not hitting on 360SkinCare.com, but on the user part of
> the email address (doesn't even look at the domain name).
> The From line didn't start with numbers (unless I'm missing your point).
It
> was the username. Are you referring to the Message-Id? It's the only line
> that seems to appear that way.
You may be missing the point. The "addr" qualifier says to look at the
address part of, in this case, the From line. So the From line probably had
something along the general lines of
From: "Anonomous P. Person" [EMAIL PROTECTED]
Loren
