ram wrote: > On Wed, 2008-04-02 at 10:23 -0700, Kelson wrote: > >> ram wrote: >> >>> header __FROMOFFICE From =~/office/i >>> header __SUBOFFICE Subject =~/office/i >>> >>> meta OFFICERULE (__FROMOFFICE || __SUBOFFICE ) >>> score OFFICERULE 4.0 >>> >> And don't forget to add word boundaries. You probably don't want it >> matching on "officer" >> >> header __FROMOFFICE From =~/\boffice\b/i >> header __SUBOFFICE Subject =~/\boffice\b/i >> >> > > For subject , yes > But I think we should not check word boundary on the from. How about the > typical 419 , we are all sick of > > From: Claimsagent <[EMAIL PROTECTED]> > > I assume the OP wants to target these > >
and how about a legitimate From: security officer ... The one I get are mostly from Welcome Office and the actual email address is [EMAIL PROTECTED]
