Hi
I'm trying to write a rule for SpamAssassin that looks for the following
in a message:
"From: " followed by "anything BUT 'Mertens Bram' or 'Bram Mertens'"
followed by ""
So these two shouldn't trigger the rule:
From: Bram Mertens
or
a match inside the body of a message, not a header...
Again thanks for the help
Bram
--
# Mertens Bram "M8ram" <[EMAIL PROTECTED]> Linux User #349737 #
# SuSE Linux 8.2 (i586) kernel 2.4.20-4GB i686 256MB RAM #
# 6:27pm up 8 days 22:04, 11 users, load
On Wed, 2004-03-31 at 03:43, Harry Putnam wrote:
[...]
> > I already have a rule that does what you suggested, it looks like:
> > headerM8RAM_FAKE_FROM From =~
> > /(?/
> > score M8RAM_FAKE_FROM 1.0
> > describe M8RAM_FAKE_FROM From contains my address but I didn't send this!
>
> Is t
ut it also means that the same answer
could return 70 times before any other is returned.
However I suppose that theoretically if you keep altering the database,
the calculation of the random number changes as well which IMHO might
cause some records te be 'skipped'. But that
means it also triggers on "From:" followed by anything that
doesn't contain my e-mail address.
The score is probably a bit high, it isn't really recommended to use
scores higher than 3.0 in a rule but I needed to counter some negative
scores some of these spoofed messages