> On 08/27/2017 10:24 PM, Rajesh M wrote:
>> hi
>>
>> we are constantly getting spam which has the following in the body of
>> the email
>>
>> dear u...@domain.com
>>
>> where u...@domain.com is the mailto email id ie our customer's email id
>>
>> is there a way to mark emails containing the mailto email id in the body
>> of the email as spam ?
>>
>> normal email communications never has such a scenario.
>>
>> rajesh
>>
>
> body DEAR_MYDOMAIN /Dear .{1,30}\@domain\.com/i
> describe DEAR_MYDOMAIN Body contains Dear u...@domain.com
> score DEAR_MYDOMAIN 1.0
Actually, it could probably be made more generic into tagging "Dear
email-address".
body DEAR_EMAIL /Dear\s+.{1,30}\@\S{1,30}\.\w{2,10}/i
describe DEAR_EMAIL Body contains Dear u...@domain.tld
score DEAR_EMAIL 1.0
(untested)
>
> --
> David Jones
>
