Quote:
|
Originally Posted by Matth
Some of the more aggressive DNSBLs have NTL's email servers on them - not sure if any on the main list are that fierce.
I've been examining the Message-ID in detail, and while I thought I'd found a great way to home in on my main repeating spammer, it doesn't seem to be completely unique:
12 hex characters $ 8 hex characters $ 8 hex characters @ 4-6 alpha
That message ID format seems to be VERY strongly indicative of a spammer, though I have seen it from other email lists - mind you, if that's the only one it's wrong on, then I just whitelist my wanted lists, and let it eat the rest - now to figure out REGEX
|
NTLs servers on a blacklist - tradgedy
I think there are existing regex rules that look at the ID. Have a look at the rule file - might be something there that will help you form the correct regex. Also, there's the regex filter manual and a forum for the plugin where users can post questions and share their regexs.