> Has anyone (probably in the UK) seen this and been able to come up with a > means (SA rules?) of detecting its characteristics, whilst avoiding false > positives? Hi, I added a basic rule to MSRBL-SPAM (http://www.msrbl.com/msrbl-spam) earlier today - it seems to be working OK for me as its stopped a few 100 so far but YMMV. Regards, ChrisB.