dman said:
> | > A legit message triggered the
> | > FROM_FORGED_HOTMAIL
> | > test. The header is
> | > From: Linda Macdonald <[EMAIL PROTECTED]>
> | >
> | > What properites of it make you think it is forged? The test appears
> | > to match any hotmail address, legit or not (though I don't really know
> | > what the "=~" operator does).
> |
> | You need to look at the whole test,
>
> Where can I find the rest of the test? The spamassassin.cf file I
> have says:
>
> header FROM_FORGED_HOTMAIL From =~ /^[^"]+\S+\@hotmail\.com/i
> describe FROM_FORGED_HOTMAIL Forged From: line claiming to be from hotmail
> .com
> score FROM_FORGED_HOTMAIL 3.0
I think Jason's thinking of another test.
This one just takes advantage of the hotmail.com formatting: hotmail
always formats From: lines as
"User Real Name" <[EMAIL PROTECTED]>
this detects it. It should be scored low though.
--j.
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
