SpamAssassin Rule To Block URL Which Contents Recipient Domain Name

2019-11-03 Thread KADAM, SIDDHESH
Hi, Can we assign a high score to mail which has an URL which contents a recipient domain name or recipient email ID ? I have been seeing lots of cases of Phish URL where spammer tries to pull end user's password by sending these URLs over mail. Regards, Siddhesh

Re: HeaderEval::check_header_count_range() not working correctly?

2019-11-03 Thread RW
On Sun, 3 Nov 2019 13:51:19 -0700 Philip Prindeville wrote: > then $uniq{A} is 4, but the number of elements in @hdrs would be 1 > (because of the ‘!’ which only passes the first). > > This seems counter-intuitive. What if I want to count the absolute > number of headers of type ‘X-yzzy:’ regard

Re: HeaderEval::check_header_count_range() not working correctly?

2019-11-03 Thread Philip Prindeville
Sigh… “downside”. > On Nov 3, 2019, at 2:32 PM, Philip Prindeville > wrote: > > What would be the downsize of having: > > my @hdrs = grep($uniq{$_}++, $pms->{msg}->get_header ($hdr)); > > instead and counting ALL instances of $hdr, not just the unique RHS’s? > > > >> On Nov 3, 2019, at 1

Re: HeaderEval::check_header_count_range() not working correctly?

2019-11-03 Thread Philip Prindeville
What would be the downsize of having: my @hdrs = grep($uniq{$_}++, $pms->{msg}->get_header ($hdr)); instead and counting ALL instances of $hdr, not just the unique RHS’s? > On Nov 3, 2019, at 1:51 PM, Philip Prindeville > wrote: > > Hi. > > I’m looking at: > > # Return true if the count

HeaderEval::check_header_count_range() not working correctly?

2019-11-03 Thread Philip Prindeville
Hi. I’m looking at: # Return true if the count of $hdr headers are within the given range sub check_header_count_range { my ($self, $pms, $hdr, $min, $max) = @_; my %uniq = (); my @hdrs = grep(!$uniq{$_}++, $pms->{msg}->get_header ($hdr)); return (scalar @hdrs >= $min && scalar @hdrs <= $max)

Re: How to make spamc learning with txrep use actual received date ?

2019-11-03 Thread RW
On Sat, 02 Nov 2019 13:23:09 -0400 Dean C wrote: > noticed was that the txrep last_hit field gets > populated with the current date/time that the email is pushed through > spamc. ... > The last_hit field is when it was run through. I think this will > mess up the expiration etc. won't it ? Thes