Re: [SPAM:9.6] Re: Smut spam

[Christian Brel <br...@copperproductions.co.uk>]

On Sat, 30 Jan 2010 09:32:31 +0000
Ned Slider <ne...@unixmail.co.uk> wrote:

> Christian Brel wrote:
> > 
> > header __HOTMAIL_SPX1 ALL =~ /Received\:.{1,30}hotmail\.com/i
> > body __HOTMAIL_SPX2 /http\:\/\/groups\.yahoo\.com/
> > meta HOTMAIL_SPAM_GY (__HOTMAIL_SPX1 && __HOTMAIL_SPX2)
> > score HOTMAIL_SPAM_GY 0.0
> > 
> 
> If I may...
> 
> To match only Received headers:
> 
> header     __HOTMAIL_SPX1        Received =~ /.{1,30}hotmail\.com/i
> 
> which incidentally will also match entries from
> this-is-not-hotmail.com 
> - may or may not be what you intended.
Indeed. It's probably fair to say that anyone using
'this-is-not-hotmail' would not really fall into my 'must have mail
from' senders, but that's just a view.
> 
> There is already a "from Hotmail" rule in 20_head_tests.cf for use in 
> meta rules that may suffice?
> 
> header   __FROM_HOTMAIL_COM    From =~ /\@hotmail\.com\b/i
> 
> Also, you can use a uri rule for URIs, for example:
> 
> uri             __HOTMAIL_SPX2       m{https?://groups\.yahoo\.com\b}
> 


It was a 'for instance' not a solid rule Ned, but as you've gone to
so much trouble please feel free to finish the job and offer the whole
rule :-)