SPAM filtering where From == To

[jdow]

On 2012/08/10 02:51, Gary Stainburn wrote:
> Hi folks.
>
> I'm using Exim and Spamassassin at work and would like to add a check.
>
> I've noticed that a lot of SPAM has the recipient in the from header. Does
> anyone know how to check for this?
>
> Gary

Yes.

If you use per user rules it's easy to create a rule to detect the
user's email address(es).

For example:
header	JD_USER_SPIKE   To =~ /spike at foobar\.com/
describe JD_USER_SPIKE  Email to self from self
score	JD_USER_SPIKE   0.001

Change the score to what you think it should be. Monitor how received
spam changes. Monitor how mismarked ham changes. (You ARE a member of
a mailing list, you know.) And decide to keep it or not.

(Using a meta rule you could exempt mailing lists, of course. But that
filter would not necessarily be self-updating. So each new mailing list
membership Spike, above, joins would require some editing.)

There is an excellent spamassassin users mailing list you might want to
join if you're at all serious about rule hacking.

{^_^}