How to score "jokes" from non-spam sources

[Terry Carmen <te...@cnysupport.com>]

Some of my users have people they normally to corrospond with, but who 
also send large numbers of massivly CC'd "jokes".

Does anybody have an example of a rule that would score messages with 
large numbers of CCs higher, without hosing filtering for the user's 
normal messages?

Thanks!

Terry

Re: How to score "jokes" from non-spam sources

[Terry Carmen <te...@cnysupport.com>]

Charles Gregory wrote:
> On Tue, 8 Dec 2009, Terry Carmen wrote:
>> Some of my users have people they normally to corrospond with, but 
>> who also send large numbers of massivly CC'd "jokes".
>> Does anybody have an example of a rule that would score messages with 
>> large numbers of CCs higher, without hosing filtering for the user's 
>> normal messages?
>
> I don't think the number of CC's alone would qualify (and might not be 
> present if someone properly uses Bcc), but many joke mails tend to 
> accumulate nested 'forwarding' headers.... You would have to examine a 
> few pieces for the pattern, but it should be fairly easy to identify 
> mail that has been repeatedly forwarded from peson to person....
That would help quite a bit. I hadn't thought about the forwarding, but 
most of them have accumulated many levels of nested quotes.

Thanks!

Terry

Re: How to score "jokes" from non-spam sources

[Charles Gregory <cg...@hwcn.org>]

On Tue, 8 Dec 2009, Terry Carmen wrote:
> Some of my users have people they normally to corrospond with, but who also 
> send large numbers of massivly CC'd "jokes".
> Does anybody have an example of a rule that would score messages with large 
> numbers of CCs higher, without hosing filtering for the user's normal 
> messages?

I don't think the number of CC's alone would qualify (and might not be 
present if someone properly uses Bcc), but many joke mails tend to 
accumulate nested 'forwarding' headers.... You would have to examine a few 
pieces for the pattern, but it should be fairly easy to identify mail that 
has been repeatedly forwarded from peson to person....

- C

Re: How to score "jokes" from non-spam sources

[Terry Carmen <te...@cnysupport.com>]

Per Jessen wrote:
> Terry Carmen wrote:
>
>   
>> Some of my users have people they normally to corrospond with, but who
>> also send large numbers of massivly CC'd "jokes".
>>
>> Does anybody have an example of a rule that would score messages with
>> large numbers of CCs higher, without hosing filtering for the user's
>> normal messages?
>>
>>     
>
> header   __MANY_CC_10    CC =~ /([^,\s]+,\s*){10}/
>
>
>   
Cool regex!

Thanks,

Terry

Re: How to score "jokes" from non-spam sources

[Per Jessen <pe...@computer.org>]

Terry Carmen wrote:

> Some of my users have people they normally to corrospond with, but who
> also send large numbers of massivly CC'd "jokes".
> 
> Does anybody have an example of a rule that would score messages with
> large numbers of CCs higher, without hosing filtering for the user's
> normal messages?
> 

header   __MANY_CC_10    CC =~ /([^,\s]+,\s*){10}/


/Per Jessen, Zürich