Hello Andy, Friday, September 17, 2004, 3:23:15 AM, you wrote:
AS> Hi, I just got a nigerian spam with a huge Reply-To: line! Never seen AS> that trick before, but I suppose it works with quite a few of the AS> recipients. Should we create a new rule for that? I can't think of AS> a legitimate reason to have more than one address in the Reply-To AS> line, right? Rule I created and tested: header RM_hrt_multireply Reply-To =~ /[EMAIL PROTECTED]@.+\@/ describe RM_hrt_multireply has multiple reply to addresses score RM_hrt_multireply 0.100 #hist RM_hrt_multireply Created by Bob Menschel, Sep 17 2004 #hist RM_hrt_multireply idea from Andy Spiegl, SA-Users #counts RM_hrt_multireply 1s/0h of 66060 corpus (40104s/25956h RM) 09/17/04 Yes, that's only one hit out of 40k spam, but at least the one hit was spam. Bob Menschel
