Hi, On Wed, Dec 6, 2017 at 9:02 AM, Benny Pedersen <m...@junc.eu> wrote: > David Jones skrev den 2017-12-06 14:54: >> >> Interesting new From: header tactic: >> >> https://pastebin.com/9BhD8m9C >> >> I have reported this to SpamcCop and Google's abuse. > > > if thay ever listing > > untested: > > header __FROM_ILLEGAL_CHARS From:name =~ /[\@?|:?]?/i > > could test it imho
I don't think it works, as per https://regexr.com/. Also, the FREEMAIL_FROM rule considers the From address to be jp9211977[at]gmail.com. Couldn't we look for multiple groups of brackets? # From: "Lottoland <accountsd...@lottolandus.com> cc: " <jp9211...@gmail.com> header __FROM_MULT_BRACKET From =~ /<.{0,40}>.{0,40}<.{0,40}>/i Also, I know David's scores are different, but is it such a good idea to assign such a large negative value to all mail passing through google? In other words, isn't all mail from google going to pass senderscore90-100, automatically giving every mail from Google an advantage? X-ENA-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=1.929, ... RCVD_IN_SENDERSCORE_90_100 -2.20, SPF_PASS -0.00)
