[Mimedefang] Fw: [Sare-users] Spam with numbers in subj and b ody

[Damrose, Mark]

> -----Original Message-----
> From: Kevin A. McGrail

> Anyway, the current rule I believe is actually worth using is 
> this and more revisions might be made at 
> http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf
> 
> #KAM NUMBER EMAILS
> header          __KAM_NUMBER1   Subject =~ /^\d+$/i
> body            __KAM_NUMBER2   /\d{1,6}/
> meta            KAM_NUMBER      ((__KAM_NUMBER1 + __KAM_NUMBER2 + 
> MIME_HTML_ONLY + HTML_SHORT_LENGTH) >= 4)
> describe        KAM_NUMBER      Silly Number Emails
> score           KAM_NUMBER      0.1

A couple other things I've noticed:  This spam always hits on
FROM_AND_TO_SAME2

and 

header	__NUMBER3   Message-ID =~ /\<[a-z]{19}\@example.com\>/
(substitute your own domain for example.com).