I've been getting a bit of spam recently via Sourceforge mailing lists
that punts live.space websites. As this is easy to detect without
running much risk of FPs, I've written a rule.....
describe MG_LIVESF Spam via SourceForge but contains spaces.live.com URI
uri __MG_LSF1 /^http:.{1,40}\.spaces\.live\.com/i
header __MG_LSF2 List-Id =~ /lists\.sourceforge\.net/i
meta MG_LIVESF (__MG_LSF1 && __MG_LSF2)
score MG_LIVESF 2.0
Of course its useless if none of your users subscribe to Sourceforge
mailing lists, but OTOH it should adapt easily to almost any group of
mailing lists that carry the List-Id: header.
Martin
