Re: Anyone have a rule to detect "Dear xxx" in the body of the message where the "To:" address is xxx@domain?

[Grant Taylor via users]

On 7/17/24 18:04, Matija Nalis wrote:

I.e. would you consider it to be significantly less likely to be spam if it contained "Dear Elizabeth," while being addressed to "mark@domain" instead of to "elizabeth@domain" ?

I've seen quite a bit of spam that opens message bodies with:

   <salutation> <local part>



Something like the following is probably a good indication that it's spam:

--8<--
Dear ux37932,


-->8--





--
Grant. . . .

Where <salutation> is "Dear" or some other greeting, often language specific and <local part> is the local part of the email address. I've missed talking to you, what is your opinion of <URL>? Please check it out and let me know what you think. If there was any doubt about the paragraph, the "ux37932" makes it quite evident to a human that the name in the salutation is not real. This is ESPECIALLY true when the name in the salutation is identical, byte for byte, including case, as the local part of the email address.

smime.p7s
Description: S/MIME Cryptographic Signature