TOM_TO_EQ_FR

[Nicolas de Bari Embriz Garcia Rojas]

I am receiving to many emails (spam) containing the same FROM  EQ TO

Initially tried to use SPF but spfquery  returns 'NONE' and I could´t score it, 
so  I ended up with the following  rules and so far working fine:

header   __TOM_TO_EQ_FRa ALL =~ m/^From:\s+?<?(.+@.+)>?(\s|$)[^\0]*^To:.*\1/m
header   __TOM_TO_EQ_FRb ALL =~ m/^To:\s+?<?(.+@.+)>?(\s|$)[^\0]*^From:.*\1/m
meta     TOM_TO_EQ_FR __TOM_TO_EQ_FRa || __TOM_TO_EQ_FRb
score    TOM_TO_EQ_FR 2.5
describe TOM_TO_EQ_FR To and From are the same, could be a cc or a forgery


regards.

signature.asc
Description: Message signed with OpenPGP using GPGMail