Tomasz Chmielewski wrote: > Is it possible to count recipients with Spamassassin? > > Some of the spam I receive has multiple recipients in To: and/or CC: > headers, i.e.: > > To: 1...@example.com, 2...@example.com, 3...@example.com > CC: 1...@example.com, 2...@example.com, 3...@example.com > > > I would like to count the number of recipients and assign score > accordingly. > > For example, when there are 5-10 recipients, assign 1 point; 11 > recipients and more - assign 2 points. > > Is it possible with Spamassassin? > >
Sure: header __COUNT_RCPTS ToCc =~ /(?:[^@,\...@[^@,\s]+)/ tflags __COUNT_RCPTS multiple meta RCPTS_5_10 (__COUNT_RCPTS >= 5 && __COUNT_RCPTS <= 10) score RCPTS_5_10 1.0 describe RCPTS_5_10 Message has 5 to 10 recipients meta RCPTS_11_PLUS (__COUNT_RCPTS > 10) score RCPTS_11_PLUS 2.0 describe RCPTS_11_PLUS Message has 11 or more recipients That will do exactly as you want. Personally I prefer this (although it does make the reports a bit more ugly as each hit will be displayed): header SCORE_RCPTS ToCc =~ /(?:[^@,\...@[^@,\s]+)/ tflags SCORE_RCPTS multiple score SCORE_RCPTS 0.2 describe SCORE_RCPTS Adding score for each recipient That will add 0.2 to the score for every recipient present in the To or Cc header which matches your desire to score +1 for 5 recipients and +2 for 10 or more but with no upper bound (so 50 recipients would add +10), personally I score this at 0.05 to be on the safe side. Kind regards, Steve.
