Bug 7864 - Suggest rule to score messages with obfuscated from
Summary: Suggest rule to score messages with obfuscated from
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Rules (show other bugs)
Version: unspecified
Hardware: PC Linux
: P2 normal
Target Milestone: Undefined
Assignee: SpamAssassin Developer Mailing List
Depends on:
Reported: 2020-10-23 12:08 UTC by ricardo.matos
Modified: 2020-10-26 11:55 UTC (History)
1 user (show)

Attachment Type Modified Status Actions Submitter/CLA Status

Note You need to log in before you can comment on or make changes to this bug.
Description ricardo.matos 2020-10-23 12:08:45 UTC
describe __FROM_2_ADDRESSES        From: Two addresses in from header
header __FROM_2_ADDRESSES  From =~ /"[^@]+\@[^@]+"\s+[^@]+\@[^@]+/i

describe __FROM_SAME       From: Same address in brackets
header __FROM_SAME         From =~ /"([^@]+\@[^@]+)"\s+<\1>/i

describe FROM_HIDDEN       From: obfuscated
meta  FROM_HIDDEN          __FROM_2_ADDRESSES && ! __FROM_SAME

score FROM_HIDDEN         2.5
Comment 1 Giovanni Bechis 2020-10-26 11:55:35 UTC
Take a look at Mail::SpamAssassin::Plugin::FromNameSpoof, some of those rules are better written that way (they can match more spamples).