spamassassin-users October 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: Checking FROM FIELD for Keywords

Re: Checking FROM FIELD for Keywords

From: John Hardin <jhardin_at_nospam>
Date: Thu Oct 14 2010 - 14:55:13 GMT
To: users@spamassassin.apache.org

On Thu, 14 Oct 2010, wvpTV wrote:

> We've seen a recent explosion in spam that SpamAssassin does not flag,
> it seems mainly because the FROM (sender) field is being used for
> subject content, eg: VIAGRA, PORN etc etc
>
> Can anyone tell me how far off a standard filter update might be to
> carry out checks on the FROM field?

There is a FROM_IN_TO_AND_SUBJ rule in my sandbox that is performing well
in masschecks. I believe it's in the current sa-update.

http://ruleqa.spamassassin.org/20101013-r1022028-n/FROM_IN_TO_AND_SUBJ/detail?srcpath=jhardin

You might want to check your scores, though; it hasn't been around long
enough to go through a net masscheck so some of the scores are still
unset.

http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/scores/72_scores.cf?view=markup

If this rule isn't appropriate, could you post a spample to pastebin so I
can get a look at the headers?

Thanks!

-- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- People seem to have this obsession with objects and tools as being dangerous in and of themselves, as though a weapon will act of its own accord to cause harm. A weapon is just a force multiplier. It's *humans* that are (or are not) dangerous. ----------------------------------------------------------------------- 64 days until TRON Legacy