text_combined: fchan ybmjpmolsciorg hi thank loren wilton think best solution kohls legitimate company subject changes month month percentages change format remains subject line body uses legitimate text taken various webpages phishing link also varies sender returnpath name different domain tried attach message apacheorg rejected thank frank im get alot february 77 variations ie january 73 guess march 75 next month thereof subject line spam body always changes cant really key would like make rule subject line filter type spam never seen one going description write rule whether match actual spam havnet seen cant say header mo_percent_off subject januaryfebruarymarchaprilmaysddsoffbi cover first half year add months necessary loren thu 07 aug 2008 192034 0800 variable subject line spam