stock_spam:if ((recv-listener == "IncomingMail") AND (body-size < 63488) AND(attachment-filetype == "gif") AND (attachment-size < 61440) AND(body-contains("(?i)cid:[0-9a-zA-Z]"))){quarantine ("Policy");}I also use this stock_spam filter but I have al...
I handle these with a message filter that checks for domain of sender and recipient being the same and then checks the SBRS score, if the domains match and the score is negative I quarentine the message.
Has anyone else noticed how coordinated these zombie machines are? My quarantines fill in almost alphabetical order from all the different hosts out there sending these Stock SPAMs, and it seems to come in waves, were I will not get hit for 5 days th...