best way to look for Bcc:d mail

[Vicki Brown <vl...@cfcl.com>]

I want to set up a High-scoring rule for mail that looks like this :(

 Date: Thu, 10 Feb 2005 17:53:31 +0200
 From: Morris Price <pk...@duse.net>
 Subject: Is your daughter a a sick person
 To: Katydid <ka...@cfcl.com>


I'm not in the To: list (the To: is a nonexistent address but that's beside
the point here). I'm not in the Cc: list (there are no Cc's). The From is not
on my whitelist.  Obviously my address is buried in the Bcc:s somewhere.

I want to bump the score if neither the To: nor the Cc: field contains my
address.

I'm guessing I want something like this:

  header __NOT_TO_ME  To !~ /vlb@cfcl.com/
  header __NOT_CC_ME  Cc !~ /vlb~cfcl.com/
  meta   NOT_FOR_ME  ( __NOT_TO_ME && __NOT_CC_ME )
  score NOT_FOR_ME 10

Or should I just try this?

  header   NOT_FOR_ME  ToCc !~ /(vlb@cfcl.com/

I can play with possibilities but I'd love a recommendation from someone who
has working code!
-- 
Vicki Brown     ZZZ                Journeyman Sourceror:
SF Bay Area, CA    zz  |\     _,,,---,,_      Scripts & Philtres
http://www.cfcl.com zz /,`.-'`'    -.  ;-;;,_Code, Doc, Process, QA
http://cfcl.com/vlb   |,4-  ) )-,_. ,\ ( `'-'Perl, Unix, Mac OS X, WWW
____________________ '---''(_/--'  `-'\_)  ___________________________

Re: best way to look for Bcc:d mail

[Matt Kettler <mk...@evi-inc.com>]

At 05:27 PM 2/10/2005, Vicki Brown wrote:
>I want to bump the score if neither the To: nor the Cc: field contains my
>address.
>
>I'm guessing I want something like this:
>
>   header __NOT_TO_ME  To !~ /vlb@cfcl.com/
>   header __NOT_CC_ME  Cc !~ /vlb~cfcl.com/
>   meta   NOT_FOR_ME  ( __NOT_TO_ME && __NOT_CC_ME )
>   score NOT_FOR_ME 10
>
>Or should I just try this?
>
>   header   NOT_FOR_ME  ToCc !~ /(vlb@cfcl.com/
>
>I can play with possibilities but I'd love a recommendation from someone who
>has working code!

I'll warn you to be very cautious about doing EITHER of the above...

In particular, mailing lists will generally hit on this rule. Including 
this message I'm writing right now. Also some legitimate newsletters, 
publications, etc will hit this rule. Not to mention that I get plenty of 
mail sent by friends announcing they are moving and they bcc it to a large 
number of people (BCC in the interest of not spreading everyone's email 
address around to everyone else)


You might try the rule, but clearly 10 points is likely to cause you 
problems with real-world nonspam mail, some hand sent by people you know well..