SPAM Messages with Subject: "wrote: "

You have to add a ruleset to your sares and update rulesdejour. Try this thread http://forums.cpanel.net/showthread.php?t=60856 and another I can't find at the moment Just do some search for recent posts with rulesdejour.

 

wrote:

seems as though this wrote: one is getting by even MailScanner.

I put this in the /etc/vfilters/domainname.com file to stop it for that domain.
# Exim filter

if not first_delivery and error_message then finish endif

if
$header_subject: contains "wrote"
then
save "/dev/null" 660
endif

Wonder if appending that to each domain file on the /etc/vfilters directory would work for a server wide filter.

 

I have the same problem...CRAZY anoying... :/

 

I get 100s of these a week, its crazy. Spam is just getting more and more senseless..

 

Stop wrote: spam

Most of those "wrote:" emails (which have now stopped for our servers) were pump & dump stock spam. The SARE_STOCKS ruleset for Spamassassin is highly effective for these.

Here's the ruleset: http://www.rulesemporium.com/rules.htm#stocks

All the best -- Bill