Re[3]: [SAtalk] Help with a score rule

2003-01-16 Thread Chris Willard
On Thursday, January 16, 2003, 12:23:30 AM, you wrote: CE> I use this: CE> # This is a reformulation of standard test VERY_SUSP_RECIPS CE> header SimilarToNames ToCc =~ /\b([a-z][a-z])[^@,<>\(\) CE> ]{0,20}(@[-a-z0-9_\.]{2,4}).{0,80}?(?:\1[^@,<>\(\) ]{0,20}\2.{0,80}?){2,}/is

Re[2]: [SAtalk] Help with a score rule

2003-01-15 Thread Christopher Eykamp
I use this: # This is a reformulation of standard test VERY_SUSP_RECIPS header SimilarToNames ToCc =~ /\b([a-z][a-z])[^@,<>\(\) ]{0,20}(@[-a-z0-9_\.]{2,4}).{0,80}?(?:\1[^@,<>\(\) ]{0,20}\2.{0,80}?){2,}/is describeSimilarToNames To: and Cc: contain similar use

Re: [SAtalk] Help with a score rule

2003-01-15 Thread Theo Van Dinter
On Wed, Jan 15, 2003 at 06:25:16PM +, Chris Willard wrote: > Is there a Perl expression that I can use that would count if the > number of "chris@" is greater than a given value (e.g. 3)? Actually 9 entries (the first, plus 8 others). You could use a similar RE to the SUSPICIOUS_RECIPS one.

Re[2]: [SAtalk] Help with a score rule

2003-01-15 Thread Chris Willard
On Tuesday, January 14, 2003, 7:47:04 PM, you wrote: TVD> On Tue, Jan 14, 2003 at 07:20:36PM +, Chris Willard wrote: >> There is very little text in the messages so they are missed by >> spamassassin. Is there a rule that I can use to spot when messages are >> addressed like this? TVD> You me

Re: [SAtalk] Help with a score rule

2003-01-14 Thread Theo Van Dinter
On Tue, Jan 14, 2003 at 07:20:36PM +, Chris Willard wrote: > There is very little text in the messages so they are missed by > spamassassin. Is there a rule that I can use to spot when messages are > addressed like this? You mean something like SUSPICIOUS_RECIPS? :) -- Randomly Generated Tag

[SAtalk] Help with a score rule

2003-01-14 Thread Chris Willard
Hi All, I keep getting spam that sends to multiple address in the form; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED] etc. There is very little text in the messages so they are missed by spamassassin. Is there a rule that I can use to spot when messages are addressed like this? -- Re