[Mimedefang] Strange mails coming in

Kevin A. McGrail kmcgrail at pccc.com
Tue Jun 6 10:13:36 EDT 2006


I *believe* that this will catch them with a minimal amount of FPs.  Running 
with a low score for more tests and added to 
www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf

#KAM NUMBER EMAILS
header          __KAM_NUMBER1   Subject =~ /\d*/i
body            __KAM_NUMBER2   /\d{1,6}/
meta            KAM_NUMBER      ((__KAM_NUMBER1 + __KAM_NUMBER2 + 
MIME_HTML_ONLY + HTML_SHORT_LENGTH) >= 4)
describe        KAM_NUMBER      Silly Number Emails
score           KAM_NUMBER      0.1

Regards,
KAM

>> I was just asked by a user about an email with a subject of 1545453 and a
>> body of 969.  It has to be related.
>
> This spam has been mentioned this morning, at http://isc.sans.org 




More information about the MIMEDefang mailing list