Debora is a huge spammers!!!!

[mikea]

On Tue, Nov 14, 2006 at 10:31:50AM -0000, Randal, Phil wrote:
> Not here they weren't.
> 
> A simple grep leads to double-counting (because I run milter-greylist),
> but my point still stands.  Was handled well by my setup without any
> additional response needed.

I've found that a lot of the "debora" spam, as well as a fair amount 
of other spam, matches /6c822ecf/ in one or more of Message-ID and 
Content-ID headers. I have yet to see a false positive. It's just as
good as the /From: akstc.*@/ signature, which is nailing a bunch even
now. 

If you run milter-regex, it's trivial to build rules for these. 

-- 
Mike Andrews, W5EGO
mikea at mikea.ath.cx
Tired old sysadmin