Robert Fitzpatrick wrote: > On Fri, 2007-08-24 at 06:48 -0700, John D. Hardin wrote: >> On Fri, 24 Aug 2007, Robert Fitzpatrick wrote: >> >>> Anyone seen these, first reported to us today, but a lot...can >>> they be stopped. Bayes even gives negative score...we are running >>> SA 3.2.1 with SARE rules, Botnet, KAM, chickenpox... >>> >>> http://esmtp.webtent.net/mail1.txt >> Hrm. About the only useful thing I can see is the number of >> recipients. You might want to add a point for more than ten or so >> addresses in the TO: header. I posted some rules for that a few days >> ago. > > Thanks for the ideas, I found your rules, but don't seem to fire on my > message after updating to 15... > > (?:,[^,]{1,80}){15} > > I'm new to my own rules. I know regex's in Perl, SQL, etc. And actually > it seems that yours is one off, where there were 15 recipients in my > message, it started matching at 14, not 15. Using the above, the first > address is not being picked up...thanks gain. >
Since that regex is looking for ,'s there would be 14 in a list of 15 recipients.
