Yeah, kerry_nice is part of [EMAIL PROTECTED] Whatever company that does these particular spams, they only address it To: [EMAIL PROTECTED], I'm the only recipient, and the subject is something like 'hello kerry_nice, get free stuff'. This one you can match the to and the subject, because getting something to kerry_somebodyelse won't feel as friendly.
But I would say this needs to be somewhat under user control, because I have some addresses that are kerry@something and kerry could show up as a legitimate subject. But if I see others like uniceka, not a friend of mine. And somebody else on this list wrote something sort of like this and they skipped it if it had an entire address. This makes sense. I get bounces sometimes that have my entire address in the subject. Kerry. Greg Ward wrote: > On 09 March 2002, Kerry Nice said: > >>#this one will only work for me, but if it there, it >>is 100% GUARANTEED to be spam >>#not sure how to make a general case for this >>header KERRYSUBJECT Subject =~ /kerry_nice/ >>describe KERRYSUBJECT Personalized subject for >>Kerry based on email address >>score KERRYSUBJECT 4.00 > > > Is "kerry_nice" per chance the local-part of the email address that > receives this spam? This sounds like another reason to tell SA your > email address(es): if the local-part of one of your addresses is in the > subject, it gets a point or two. > > Alternately, SA could look at the Envelope-to header that some MTAs add. > No, wait, that won't work because of forwarding... it could look for the > "for" clause of each Received header, which (informally) records each > envelope recipient along the way. Then consider the list of email > addresses there as "your addresses", and use them to look for things > like > > Subject: kerry_nice > > or, my pet peeve: > > To: gward <[EMAIL PROTECTED]> > > which is also a pretty sure spam marker for me. > > Greg __________________________________________________ Do You Yahoo!? Try FREE Yahoo! Mail - the world's greatest free email! http://mail.yahoo.com/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
