ram wrote:
> On Wed, 2008-04-02 at 10:23 -0700, Kelson wrote:
> =20
>> ram wrote:
>> =20
>>> header __FROMOFFICE From =3D~/office/i
>>> header __SUBOFFICE Subject =3D~/office/i
>>>
>>> meta OFFICERULE (__FROMOFFICE || __SUBOFFICE )
>>> score OFFICERULE 4.0
>>> =20

>> And don't forget to add word boundaries. You probably don't want it=20
>> matching on "officer"
>>
>> header __FROMOFFICE From =3D~/\boffice\b/i
>> header __SUBOFFICE Subject =3D~/\boffice\b/i
>>
>> =20

>
> For subject , yes=20
> But I think we should not check word boundary on the from. How about =

the
> typical 419 , we are all sick of=20
>
> From: Claimsagent
>
> I assume the OP wants to target these
>
> =20


and how about a legitimate
From: security officer ...


The one I get are mostly from

Welcome Office and the actual email address is=20

clientele@welcomeoffice.emv1.net=20