# This is a reformulation of standard test VERY_SUSP_RECIPS
header SimilarToNames ToCc =~ /\b([a-z][a-z])[^@,<>\(\) ]{0,20}(@[-a-z0-9_\.]{2,4}).{0,80}?(?:\1[^@,<>\(\) ]{0,20}\2.{0,80}?){2,}/is
describe SimilarToNames To: and Cc: contain similar usernames at least 3 times
score SimilarToNames 3
At 06:25 PM 1/15/2003 +0000, Chris Willard wrote:
On Tuesday, January 14, 2003, 7:47:04 PM, you wrote: TVD> On Tue, Jan 14, 2003 at 07:20:36PM +0000, Chris Willard wrote: >> There is very little text in the messages so they are missed by >> spamassassin. Is there a rule that I can use to spot when messages are >> addressed like this?TVD> You mean something like SUSPICIOUS_RECIPS? :) Hi Theo, I've had a look. This looks OK but does it only trigger if there are 8 or more entries? Is there a Perl expression that I can use that would count if the number of "chris@" is greater than a given value (e.g. 3)? -- Regards, Chris Willard [EMAIL PROTECTED] ------------------------------------------------------- This SF.NET email is sponsored by: A Thawte Code Signing Certificate is essential in establishing user confidence by providing assurance of authenticity and code integrity. Download our Free Code Signing guide: http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0028en _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This SF.NET email is sponsored by: A Thawte Code Signing Certificate is essential in establishing user confidence by providing assurance of authenticity and code integrity. Download our Free Code Signing guide:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0028en
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
