On 1/18/2018 6:52 AM, Pedro David Marco wrote:
> David,
>
> This rule can do the full job... i have tested it with good results..
> (Can be tested here: https://regex101.com/r/Vpmhjz/3 )
>
> It checks if the level domain next to the TLD in the From:name matches
> the domain next to the TLD in Fro
>
>>> There are spams hitting negative scoring rules e.g. MAILING_LIST_MULTI,
>>> RCVD_IN_RP_*, RCVD_IN_IADB_* and they are constantly trained as ham.
Just a reminder, if you ever receive spam which is tagged as RCVD_IN_IADB (or
*any* flavour of IADB tag) *please* forward it to me personal
