On Fri, 18 Oct 2013, Kevin A. McGrail wrote:
On 10/18/2013 10:04 AM, Lutz Petersen wrote:
I'm searching a way to give some extra Score depending on the Number
of Recipients in the To: Headerline. In the last days there are
massive Spamruns that are not marked as Spam - but all of them have
a lot of Recipient Mail-Adresses in the To-Line (the last one more
than 50..). I didn't found any Rule that does this. Anyone knows
a solution ?
You might need to write a rule for multiple separators on the To: line or
something tricky like that.
There are already subrules for this (__TO_TOO_MANY and __TO_WAY_TOO_MANY)
in my sandbox.
http://ruleqa.spamassassin.org/?daterev=20131017-r1533008-n&rule=%2FTOO_MANY&srcpath=jhardin
They aren't performing too well against the masscheck corpora, so I
haven't made metas to use them, but you may be able to leverage them in
metas for your specific traffic.
header __TO_TOO_MANY To =~ /(?:,[^,]{1,90}){30}/
header __CC_TOO_MANY Cc =~ /(?:,[^,]{1,90}){30}/
header __TO_WAY_TOO_MANY ToCc =~ /(?:,[^,]{1,90}){50}/
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
You do not examine legislation in the light of the benefits it
will convey if properly administered, but in the light of the
wrongs it would do and the harms it would cause if improperly
administered. -- Lyndon B. Johnson
-----------------------------------------------------------------------
505 days since the first successful private support mission to ISS (SpaceX)
