Re: false positive: KHOP_BIG_TO_CC

[Tom Hendrikx <to...@whyscream.net>]

Hi,

Raising an old thread again, I'm also seeing FPs on this one. No real
changes have been made as far as I can see: a high score and no increase
of number of recipients (nor anything else)...

Regards,
	Tom

On 10/02/2013 01:37 PM, Daniel McDonald wrote:
> On 10/2/13 6:30 AM, "Tony Finch" <do...@dotat.at> wrote:
> 
>> We've had a report from a user about a false positive involving
>> KHOP_BIG_TO_CC which has a score of 3.4. This seems like an excessive
>> penalty for perfectly reasonable behaviour.
> 
> I've also seen false positives on this.  I was going to change it to 25
> addresses locally, but haven't gotten around to it yet.
> 
>>
>> header   KHOP_BIG_TO_CC  ToCc =~ /(?:[^,\@]{1,60}\@[^,]{4,25},){10}/
>> describe KHOP_BIG_TO_CC  Sent to 10+ recipients instaed of Bcc or a list
>> score    KHOP_BIG_TO_CC  3.199 3.399 3.199 3.399
>>
>> Tony.
>