On 01/04/15 17:41, Amir Caspi wrote:
Going back to this:
On Apr 1, 2015, at 7:47 AM, Bowie Bailey <bowie_bai...@buc.com> wrote:
Well, this wouldn't be the first or only rule that doesn't work for everyone... plus, I would
certainly make it case sensitive, so that "John" wouldn't match "john@", for
example. This rule could be disabled by default and turned on by people who want it, or vice
versa. I'd also imagine it would generate a lower score from masscheck than the regular TO_IN_SUBJ
would, and hence would be of less impact towards FPs (but that extra few-tenths of a point could
make the difference to push a lot of these spams over the threshold, particularly if they hit
BAYES_999 but not any other rules, as many snowshoe spams often do in the early stages).
Anyway, it was just a thought... I'd certainly support such a rule, even if it
had to be manually enabled or rescored.
Untested, but this might work, adjusted from existing __SUBJ_HAS_TO rules
---8<---
header __SUBJ_HAS_TO_LOCAL_1 ALL =~
/\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s>@,]+)@(?:[^\n>]+)>?\n(?:[^\n]{1,200}\n)*Subject:\s+[^\n]{0,100}\1[>,\s\n]/sm
header __SUBJ_HAS_TO_LOCAL_2 ALL =~ /\nReceived:[^\n]{0,200} for
<?([^\n\s>;@]+)@(?:[^\n>]+)>?;(?:[^\n]+\n)*Subject:\s+[^\n]{0,100}\1[>,\s\n]/sm
header __SUBJ_HAS_TO_LOCAL_3 To:addr !~ /^(?:info|abuse|support)@/
meta __TO_LOCAL_IN_SUBJ (__SUBJ_HAS_TO_LOCAL_1 ||
__SUBJ_HAS_TO_LOCAL_2) && __SUBJ_HAS_TO_LOCAL_3
meta TO_LOCAL_IN_SUBJ __TO_LOCAL_IN_SUBJ && !__VIA_ML &&
!MISSING_MIMEOLE && !__THREAD_INDEX_GOOD && !__FSL_RELAY_GOOGLE &&
!__LCL__ENV_AND_HDR_FROM_MATCH && !__HS_SUBJ_RE_FW
describe TO_LOCAL_IN_SUBJ To local part is in Subject
score TO_LOCAL_IN_SUBJ 0.01
---8<---
Paul
--
Paul Stead
Systems Engineer
Zen Internet
