John D. Hardin wrote:
> On Fri, 17 Aug 2007, aag_uk wrote:
> (1) Check your MTA options. Some allow you to configure rejection of a=20
> message after X number of invalid recipients are given.
> (2) Consider a rule that adds a point if more than X names appear in=20
> the TO: and/or CC: headers. Here are mine (20 is the limit):
> describe TO_TOO_MANY To: too many recipients
> header TO_TOO_MANY To =3D~ /(?:,[^,]{1,80}){20}/
> score TO_TOO_MANY 1.50
> describe CC_TOO_MANY Cc: too many recipients
> header CC_TOO_MANY Cc =3D~ /(?:,[^,]{1,80}){20}/

Thanks for your answer, but the spam I=C2=B4m trying to identify is not abo=
ut too
many recipients, usually it=C2=B4s only 5 or 6, and they all contain correc=
email addresses. The thing is that some spammers make up the name that goes
before the email address (e.g. "John Smith")

View this message in context:
Sent from the SpamAssassin - Users mailing list archive at