diff --git a/ChangeLog b/ChangeLog
index b2a98046..31d16fa1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -66,6 +66,7 @@ configuration before relying on it.
      failregex / ignoreregex
    * [..e019ab7] Multiple instances of the same action are allowed in the
      same jail -- use actname option to disambiguate.
+   * Add honeypot email address to exim-spam filter as argument
 
 ver. 0.8.12 (2013/12/XX) - things-can-only-get-better
 -----------
diff --git a/config/filter.d/exim-spam.conf b/config/filter.d/exim-spam.conf
index 15737b2f..24c80bdd 100644
--- a/config/filter.d/exim-spam.conf
+++ b/config/filter.d/exim-spam.conf
@@ -12,9 +12,19 @@ before = exim-common.conf
 failregex =  ^%(pid)s \S+ F=(<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$
              ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: .*dnsbl.*\s*$
              ^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
+             ^%(pid)s \S+ SA: Action: flagged as Spam but accepted: score=\d+\.\d+ required=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=\S+ \[<HOST>\]\) for <honeypot>$
 
 ignoreregex = 
 
+[Init]
+
+# Option:  honeypot
+# Notes.:  honeypot is an email address that isn't published anywhere that a
+#          legitimate email sender would send email too.
+# Values:  email address
+
+honeypot = trap@example.com
+
 # DEV Notes:
 # The %(host_info) defination contains a <HOST> match
 #