> -----Original Message----- > From: Bogdan Ćulibrk [mailto:b...@default.rs] > Sent: Thursday, March 26, 2009 10:58 AM > > McDonald, Dan wrote: > > On Mon, 2009-03-23 at 15:44 +0100, Ivan Savcic wrote: > >> On Mon, Mar 23, 2009 at 3:08 PM, Mark Martinec > <mark.martinec...@ijs.si> wrote: > >>> Bogdan, > >>> > >>>>> The test is supposed to receive a header as argument, not a body: > >>>> thanks for the reply. What I am trying to do is actually have > access map > >>>> of blacklisted email addresses or websites that are mentioned in > the > >>>> *body* of email, not in header. > > > > have you looked at the freemail plugin? It might give you some ideas > > how to do what you want. > > > > > > Hello, > > thanks for pointer, but here's one question: wouldn't this plugin give > false positive on scenario where corresponding with legitimate > u...@gmail.com that mentions some other gmail email in manner: > > "hi m8, here is Bob's email I've mentioned you on today on coffee break > mailto:b...@yahoo.com";.
Right, of course: it would fire both FREEMAIL_FROM and FREEMAIL_REPLYTO, contributing for 2.5 points to the message's score. So what? The message would pass untouched if no other rule fires... Most of the SA rules and plugins are meant to give their own contribution in identifying spam, not each one acting as a rude knife. Some rule fire on very legit messages, by the way... Giampaolo > Thanks, > Bogdan
