> Is there a custom rule that can be kicked in to detect multiple recipients
> of the same email?
header LW_MULT_RECIP3 ToCc =~
/(?:"[^"]{0,31}")?\@([^\s,]+)(?:(?:"[^"]{0,31}")[EMAIL PROTECTED]@\1){2}/
describe LW_MULT_RECIP3 Three or more recipients in same domain
score LW_MULT_RECIP3 1
I have a set of those with increasing numbers of recipients and increasing
scores. (But remember that all of the scores for the smaller matches will
add to the total score.) Generally in my case if I see 8 recipients at the
same ISP, it is guaranteed spam. That may not be the case for everyone.
Change the very last number in braces ({2} in this case) to change the
number of required recipients. Remember that this is one less than the
number of recipients that must hit.
Loren
