Re: "Pill" spams

On 4/9/2012 5:39 PM, Thomas Johnson wrote:
> Getting a bunch of these, and I'm getting very low scores, using the
> latest spamassassin rules, and the most common third-party rulesets.
>
> Also using spamhaus, investment and other DNSBLs, but my users seem to
> be getting these before the urls are making their way into those
> DNSBLs.
>
> The subject is about various types of pills, and I do note that the
> Subject line header is often in mixed case - not just the subject
> itself, but even the word "subject" - it might be "SubjeCT" or
> "subjeCT" or "SUBJect", but I don't see a rule for anything like this.

That sounds like it might be good rule-fodder. "subject", "Subject",
and "SUBJECT" are possibly valid, but the other funky capitalizations
might be worth a few points.

-- Bowie

• This message: [ Message body ]
• Next message: corpus.defero: "Re: Invalid Date: header (not RFC 2822)"
• Previous message: Swati R: "Re: meta rules assistance"
• In reply to: Thomas Johnson: ""Pill" spams"
• Next in thread: Thomas Johnson: "Re: "Pill" spams"
• Reply: Thomas Johnson: "Re: "Pill" spams"

• Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]