On 2019-11-22 01:00, Martin Gregorie wrote:

describe SPOOFED_MAYOR Check for spoofed mail from the Mayor
header   __SM1         From:name =~ /^John M Mayor$/
header   __SM2         From:addr =~ /^john\@cityhall\.com$/
meta     SPOOFED_MAYOR (__SM1 && ! __SM2) || ! _SM1
score    SPOOFED_MAYOR 5.0

he atleast now loves anyone equal :=)

meta     SPOOFED_MAYOR1 __SM1 && ! __SM2
score    SPOOFED_MAYOR1 5.0

meta     SPOOFED_MAYOR2 ! _SM1
score    SPOOFED_MAYOR2 0.1

Reply via email to