Re: How to stop these?

On Fri, 2007-08-24 at 06:48 -0700, John D. Hardin wrote:
> On Fri, 24 Aug 2007, Robert Fitzpatrick wrote:
>
> > Anyone seen these, first reported to us today, but a lot...can
> > they be stopped. Bayes even gives negative score...we are running
> > SA 3.2.1 with SARE rules, Botnet, KAM, chickenpox...
> >
> > http://esmtp.webtent.net/mail1.txt
>
> Hrm. About the only useful thing I can see is the number of
> recipients. You might want to add a point for more than ten or so
> addresses in the TO: header. I posted some rules for that a few days
> ago.

Thanks for the ideas, I found your rules, but don't seem to fire on my message after updating to 15...

(?:,[^,]{1,80}){15}

I'm new to my own rules. I know regex's in Perl, SQL, etc. And actually it seems that yours is one off, where there were 15 recipients in my message, it started matching at 14, not 15. Using the above, the first address is not being picked up...thanks gain.

-- 
Robert