> -----Original Message----- > From: Paul Barbeau [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 31, 2004 8:32 AM > To: [EMAIL PROTECTED] > Subject: Feedback Please > > > In an effort to push some border line spam over into full > fledged spam i > wrote this rule. As i do not know if there is a variable > that store the > "to" i make it for the whole domain. It has been working > quite well with no > FP however some real mailing lists have gotten the score up a > bit (if they > use the email address in a remove link). Does anyone see any > problem doing > this? and is there any error in my code? > > uri HN_EMAIL1 > /\@(npn.ca|hypernet.ca|prospectus.com|)/i > describe HN_EMAIL1 there is a url with what looks > like a email > address in it > score HN_EMAIL1 3.00 > > Paul > > PS. Thanks to Mat for helping me with this.
I had run a similar rule here for our company. It turned out horrible! FPs every which way. Like you said, mostly from unsub links. And you can't tell the unsub ham from spam. I abandoned the whole idea in favor of finding other methods. It just wouldn't pan out for me. IT also hit on personal account info links. Like "Click here to see your account" and they use their email as username. Maybe for a single user who can whitelist groups/lists they are on. But for a group of people, I would stay away. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin Charles Darwin
