On 12/20/2018 03:11 PM, Amir Caspi wrote:
Two or more dots in the From username seems to be rather spammy (and we've talked about it before on the list).
I feel obligated to comment that my wife's email address (Gmail) has two dots in it. (Gmail is it's own can of worms for dots as they strip them, and other issues with Gmail.) As do a number of other people that I exchange email with.
Would you mind sandboxing this test rule to see if it would be helpful
as a main rule? I get a lot of spam locally that hits this...
header AC_FROM_MANY_DOTS From =~ /<(?:\w+\.){2,}\w+@/
describe AC_FROM_MANY_DOTS Two or more periods in the From username
We could, of course, increase to three or more dots... maybe the three-dot
version would score higher on its own, but the two-dot could be better
in combo... not sure.
Can't SpamAssassin add something to the score for each dot?I just checked and my 249,000+ message corpus has 2,600+ message with two or more dots in the user part of the email address (From:addr).
-- Grant. . . . unix || die
smime.p7s
Description: S/MIME Cryptographic Signature
