> -----Original Message----- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 20, 2003 10:32 PM > To: Chris Santerre > Cc: Spamassassin-Talk (E-mail) > Subject: Re: [SAtalk] [RD] New header rule for no FQDN ? > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello Chris, > > Wednesday, August 20, 2003, 7:15:31 AM, you wrote: > > CS> What do you guys think of this simple header line: > CS> Received: from Evan ([81.68.237.96]) > > CS> How does this regex look? > CS> header WRKSTATION_NAME Received =~ /^from \w+ > CS> \(\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\]\)/ > CS> describe WRKSTATION_NAME Email server didn't have a FQDN > CS> score WRKSTATION_NAME 0.01 > > Your regex matches two emails in my corpus, both from the same foreign > source, to two email addresses we've published for foreign vendors. > Therefore I can't say it matches spam, but certainly it matches an > unusual occurrence. > > Bob Menschel >
Thanks for all the input guys! I'm looking into the different permutations on this same theme. There 'seems' to be a spamish pattern to it, but I agree that there is probably some legit headers. But that is worth a .33 point in my book. :) Thanks again!! --Chris Santerre For giggles, check out http://SpamAssassin.youaremyfriend.com IT has lots of popups though. :( (Useless in a text browser. it has sounds and flash and all the things we love to hate!) ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
