Re: A way to score Number of Recipients in the To: Line ?

[ha...@t-online.de]

Kevin A McGrail wrote:

>> On 10/18/2013 10:04 AM, Lutz Petersen wrote:
>> >
>> > I'm searching a way to give some extra Score depending on the Number
>> > of Recipients in the To: Headerline. In the last days there are
>> > massive Spamruns that are not marked as Spam - but all of them have
>> > a lot of Recipient Mail-Adresses in the To-Line (the last one more
>> > than 50..). I didn't found any Rule that does this. Anyone knows
>> > a solution ?
>> >
>> > Lutz Petersen
>> I don't believe you will find that to be an accurate indicator of SPAM 
>> unless you have a meta rule in mind.  Spam and Ham both use multiple 
>> recipients all the time so this is a waste of time in my off the cuff 
>> opinion but I don't want to disparage you if you are certain you can use 
>> it to identify the spam.
>> 

Hi,

while multiple recipients are common in ham, I would expect them only from known
senders (and in fact senders known to use address lists on purpose) - if I am member of a club,
choir or something and get invitations, that's fine. If I get list-addressed mail from some of
my regular correspondents, it could be an announcement to most of the people
in the sender's address book ... but it could also be the result of some malware that
captured the sender's addresses.

I have some filtering in place, but it happens outside (before) SA checking, and sends
offending messages to the antivirus quarantine folder. It requires a whitelist

Reagrds
Wolfgang Hamann

Re: A way to score Number of Recipients in the To: Line ?

[Dave Warren <da...@hireahit.com>]

On 2013-10-18 23:21, hamann.w@t-online.de wrote:
> hile multiple recipients are common in ham, I would expect them only from known
> senders (and in fact senders known to use address lists on purpose)

Or a customer who feels they are being ignored and takes the shotgun 
approach hoping that someone, anyone, will answer them.

Or an employee who's in an emergency, doesn't have access to his work 
email account and emails a bunch of managers hoping someone will jump on 
his issue ASAP because his car was just totaled.

More importantly, not that many spammers list tons of addresses in the 
TO field. I believe that in general, this one will be a wash, although 
there certainly will be specific situations where this type of filtering 
may be useful.

-- 
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren