On 13/11/14 17:07, Paul Stead wrote:
FROM_2_EMAILS - inspired by the Khopesh rule of the same name. Matches
when the from name contains an email address different to the from
address, such as:
From: "t...@example.com" <u...@anotherdomain.com>
----8<----
header __PDS_FROM_2_EMAILS From =~
/^\W+([\w+.-]+\@[\w.-]+\.\w\w++)(?:[^\n\w<]{0,80})?<(?!\1)[^\n\s]*\@/i
meta PDS_FROM_2_EMAILS ((__PDS_FROM_2_EMAILS) && !(__VIA_ML &&
__VIA_RESIGNER))
----8<----
Any feedback on this rule? Re-looking at the current sandbox rule this
is different - the current rule looks for any 2 email addresses in the
From header.
My rule specifically looks for two different addresses, also the rule
doesn't match on From headers such as
From: "t...@example.com [yahoo group]" <gr...@yahoo.com>
which caused a few FPs. Only where it looks like the Name is trying to
masquerade as a different from address - it lacks power to look at
Reply-to address etc, my regex was wearing out that day :)
--
Paul Stead
Systems Engineer
Zen Internet
