Kevin A McGrail wrote: >> On 10/18/2013 10:04 AM, Lutz Petersen wrote: >> > >> > I'm searching a way to give some extra Score depending on the Number >> > of Recipients in the To: Headerline. In the last days there are >> > massive Spamruns that are not marked as Spam - but all of them have >> > a lot of Recipient Mail-Adresses in the To-Line (the last one more >> > than 50..). I didn't found any Rule that does this. Anyone knows >> > a solution ? >> > >> > Lutz Petersen >> I don't believe you will find that to be an accurate indicator of SPAM >> unless you have a meta rule in mind. Spam and Ham both use multiple >> recipients all the time so this is a waste of time in my off the cuff >> opinion but I don't want to disparage you if you are certain you can use >> it to identify the spam. >>
Hi, while multiple recipients are common in ham, I would expect them only from known senders (and in fact senders known to use address lists on purpose) - if I am member of a club, choir or something and get invitations, that's fine. If I get list-addressed mail from some of my regular correspondents, it could be an announcement to most of the people in the sender's address book ... but it could also be the result of some malware that captured the sender's addresses. I have some filtering in place, but it happens outside (before) SA checking, and sends offending messages to the antivirus quarantine folder. It requires a whitelist Reagrds Wolfgang Hamann
