ram wrote:
On Wed, 2008-04-02 at 10:23 -0700, Kelson wrote:
ram wrote:
header __FROMOFFICE From =~/office/i
header __SUBOFFICE Subject =~/office/i
meta OFFICERULE (__FROMOFFICE || __SUBOFFICE )
score OFFICERULE 4.0
And don't forget to add word boundaries. You probably don't want it
matching on "officer"
header __FROMOFFICE From =~/\boffice\b/i
header __SUBOFFICE Subject =~/\boffice\b/i
For subject , yes
But I think we should not check word boundary on the from. How about the
typical 419 , we are all sick of
From: Claimsagent <[EMAIL PROTECTED]>
I assume the OP wants to target these
and how about a legitimate
From: security officer ...
