On Fri, 12 Dec 2003 01:38:16 -0500, Bryan Hoover <[EMAIL PROTECTED]>
posted to spamassassin-talk:
> [EMAIL PROTECTED] wrote:
>> For many of these, one can observe that the "user name" in the From:
>> header often also occurs in the Subject line. This could be a useful
>> rule pattern, although
[EMAIL PROTECTED] wrote:
> For many of these, one can observe that the "user name" in the From:
> header often also occurs in the Subject line. This could be a useful
> rule pattern, although there are bound to be false positives, so the
> score should be rather low.
>
> I don't know off-hand if t
[EMAIL PROTECTED] wrote:
> /^Reply-to:\s*(<[-a-z0-9_.]+\@([-a-z0-9_]+\.)+[a-z]+>)\s+\1/i
>
> Underscore is not technically valid in a domain name but you do see
> them in practice anyway.
>
> I'm not sure this is any better than what I originally posted, as I
> haven't tested this properly. My
On Sun, 7 Dec 2003 00:28:31 -0600, Robert Nicholson <[EMAIL PROTECTED]>
posted to spamassassin-talk:
> I've got a mailbox full of messages that got past SA
> They are all from the same spammer.
Hmm, not all of these have the Reply-to pattern which the followups
were concentrating on. Here are th
On Wed, 10 Dec 2003 01:44:56 -0500, Bryan Hoover <[EMAIL PROTECTED]>
posted to spamassassin-talk:
> [EMAIL PROTECTED] wrote:
>> > /^reply-to:[EMAIL PROTECTED](\.org|\.net)[EMAIL PROTECTED](\.org|\.net)\$/igm
>> This is probably a sufficient pattern, but one distinguishing feature
>> in the exam
[EMAIL PROTECTED] wrote:
> > /^reply-to:[EMAIL PROTECTED](\.org|\.net)[EMAIL PROTECTED](\.org|\.net)\$/igm
>
> This is probably a sufficient pattern, but one distinguishing feature
> in the examples was that the same address would be repeated twice.
Think there were instances with two different
On Sun, 07 Dec 2003 17:19:26 -0500, Bryan Hoover <[EMAIL PROTECTED]>
posted to spamassassin-talk:
> Robert Nicholson wrote:
>> Reply-To: <[EMAIL PROTECTED]>
>> <[EMAIL PROTECTED]>
>> Do we have a way of dealing with the spammer who's Reply-To's always
>> look the same?
> Oh, but it's
Robert Nicholson wrote:
>
> I've got a mailbox full of messages that got past SA
>
> They are all from the same spammer.
What sort of stuff is in the messages?
And if it's a bulk send -- that is, a real spammer, as opposed to
someone targeting only you (which would be, most likely, for the most
