On Tue, 6 Apr 2004, Philip Hazel wrote:
> On Mon, 5 Apr 2004, Tom Kistner wrote:
>
> > NB: Philip, I did not receive your message:
> >
> > 0.9 FROM_ENDS_IN_NUMS From: ends in numbers
> > 'ph10' ... sigh
>
> I'm afraid my "from" has ended in "nums" since 1972... blame my parents
> for not giving me enough names. :-)
>
> > 1.1 MAILTO_TO_SPAM_ADDR URI: Includes a link to a likely spammer email
> > I wonder what that was?
>
> Indeed.
This is a counterpart to FROM_ENDS_IN_NUMS which applies a similar rule to
email addresses (not just mailto: links) found in the body of a message.
Because of the format of Cambridge email addresses, we have local rules to
compensate. (These scores are for older versions of SpamAssassin.)
header FROM_CRSID From =~ /\d\d\@([a-z0-9-]+\.)?cam\.ac\.uk/i
describe FROM_CRSID From: is a CRSID
score FROM_CRSID -0.74
uri MAILTO_CRSID /^mailto:[a-z]+\d{2,}\@([a-z0-9-]+\.)?cam\.ac\.uk/i
describe MAILTO_CRSID Includes a mailto: link to a CRSID
score MAILTO_CRSID -0.38
> > 3.0 SUSPICIOUS_RECIPS Similar addresses in recipient list
> >
> > "'exim-users@???'" <exim-users@???>,
> > "exiscanusers@???" <exiscanusers@???>
>
> Sigh.
That is a very odd test.
--
Tony Finch <dot@???>
http://dotat.at/
