Craig Hughes wrote >on 1/31/02 9:07 AM, Greg Ward at [EMAIL PROTECTED] wrote: >> Someone on the Exim list is trying to filter out messages that look >> like this: >> >> To: [EMAIL PROTECTED] >> Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], >> [EMAIL PROTECTED], [EMAIL PROTECTED], >> [EMAIL PROTECTED], [EMAIL PROTECTED], >> >> ... ie. same local-part repeated many times in various recipient >> headers. Seems like a good spam flag to me, but I don't recall seeing >> a rule like this when browsing SA's current ruleset. Is it there? >> If not, should it be added? >> >> Greg
>Yes, there are a number of rules designed to catch exactly this behavior. >Look in 20_head_tests.cf for the '*SUSP*' rules. They catch both the stuff >you mention below, and even do a pretty good job with stuff like: > >To: erica@blah >Cc: erica@foo, eric@bar, ernie@baz > >C I have a very unusual name: Jones <g> -- and my userid is: jonz. One of my _personal_ spam filters is detecting "jones"es in the To: and Cc: lists. I presume these come about from spammers using the Encyclopedia Of Harvested Addresses (tm) -- which tends to gather like-names around each other. I still catch a few that arrive this-a-way -- even tho' spamassassin didn't 'tag' them. (Another one of my _personal_ spam filters is a test for it _NOT_ being To:, or Cc: my userid. That, too, catches a few that sa doesn't 'tag'.) Regards, Jonesy -- | Marvin L Jones | jonz | W3DHJ | OS/2 | Gunnison, Colorado | @ | Jonesy | linux __ | 7,703' -- 2,345m | frontier.net | DM68mn SK _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
