On Saturday 21 February 2004 18:39, Dan Bullock wrote: > Gary Smith wrote: > >It should be possible using a set of meta rules in a compound statement. > > How about this. +15 for any ebay address, but -100 for an ebay address > that has an MTA of ebay.com ? > > > # EBAY > header CS_EBAY_FROM From =~ /ebay.com\b/i > describe CS_EBAY_FROM FROM AN EBAY ADDRESS > score CS_EBAY_FROM 15.0 > whitelist_from_rcvd [EMAIL PROTECTED] ebay.com
How far back in the headers does that check? I've been seeing spam where the first hop is a faked received from valid_ebay_ip by the spammer's host...
