McDonald, Dan pisze: > I'm considering a low-scoring rule like: > body AE_MEDS37 /\(\s?w{2,4}\s[:alpha:]{4}\d{1,4}\s(?:net|com|org)\s?\)/ > describe AE_MEDS37 rule to catch the next wave of spaced domains > score AE_MEDS37 1.0
Hi Dan, I have score 4.0 for that kind of spam, but I can see that even such high score is not sufficient sometimes. My SA tags that messages as spam only if they also pass RCVD_IN_BL_SPAMCOP_NET and RCVD_IN_SORBS_DUL tests. My best regards, Pawel