On 10/17/2011 08:42 PM, Tom wrote: > I'm using a couple rules I found here that hits when there are 5-9 or > 10+ recipients: > > header __COUNT_RCPTS ToCc =~ /(?:[^@,\s]+@[^@,\s]+)/ > tflags __COUNT_RCPTS multiple > > meta RCPTS_5_10 (__COUNT_RCPTS >= 5) > score RCPTS_5_10 1.0 > describe RCPTS_5_10 Message has 5 or more recipients > > meta RCPTS_10_PLUS (__COUNT_RCPTS >= 10) > score RCPTS_10_PLUS 1.0 > describe RCPTS_10_PLUS Message has 10 or more recipients
We get requests for this all the time on this list. Several implementations have been made and then removed (some may even still exist in svn sandboxes) for their poor performance. While none of them (including your own) have specifically hunted freemail recipients, I can tell you from experience that this won't help reduce false positives.
signature.asc
Description: OpenPGP digital signature
