<br><br><div class="gmail_quote">2009/7/22 Gottschalk, David <span dir="ltr"><<a href="mailto:dgottsc@emory.edu">dgottsc@emory.edu</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Is it possible to setup MailScanner to block/quarantine messages over a certain number of recipients? I want to do this because we have a lot of accounts being compromised and sending out emails to a large number of recipients. I think this would be a good proactive measure.<br>
<br>
I've looked into spamassassin doing this, but cannot find anything that would give me the ability to do this.<br>
<br>
Any tips would be appreciated, I've searched all around and haven't found anything.</blockquote><div><br>Some time ago i wrote this rule for SpamAssassin, i didnt test it a lot, so test it with precaution. I was for someone with the same problem than you.<br>
<br>the logic of the rule is that if the email has more than 10 recipients at least 1 rule will hit, with combination is probable than more than one hits. you can also generate a new meta rule to have only 1 hit with an OR.<br>
<br>header __TEST_TO_1 To =~ /(.*?(@).*?){1,}/i<br>header __TEST_TO_2 To =~ /(.*?(@).*?){2,}/i<br>header __TEST_TO_3 To =~ /(.*?(@).*?){3,}/i<br>header __TEST_TO_4 To =~ /(.*?(@).*?){4,}/i<br>
header __TEST_TO_5 To =~ /(.*?(@).*?){5,}/i<br>header __TEST_TO_6 To =~ /(.*?(@).*?){6,}/i<br>header __TEST_TO_7 To =~ /(.*?(@).*?){7,}/i<br>header __TEST_TO_8 To =~ /(.*?(@).*?){8,}/i<br>
header __TEST_TO_9 To =~ /(.*?(@).*?){9,}/i<br>header __TEST_TO_10 To =~ /(.*?(@).*?){10,}/i<br><br>header __TEST_CC_1 Cc =~ /(.*?(@).*?){1,}/i<br>header __TEST_CC_2 Cc =~ /(.*?(@).*?){2,}/i<br>
header __TEST_CC_3 Cc =~ /(.*?(@).*?){3,}/i<br>header __TEST_CC_4 Cc =~ /(.*?(@).*?){4,}/i<br>header __TEST_CC_5 Cc =~ /(.*?(@).*?){5,}/i<br>header __TEST_CC_6 Cc =~ /(.*?(@).*?){6,}/i<br>
header __TEST_CC_7 Cc =~ /(.*?(@).*?){7,}/i<br>header __TEST_CC_8 Cc =~ /(.*?(@).*?){8,}/i<br>header __TEST_CC_9 Cc =~ /(.*?(@).*?){9,}/i<br>header __TEST_CC_10 Cc =~ /(.*?(@).*?){10,}/i<br>
<br>#just for testing purposes<br>#meta TEST_TO_1_CC_1 (__TEST_TO_1 && __TEST_CC_1)<br>#<br><br>meta TEST_TO_1_CC_9 (__TEST_TO_1 && __TEST_CC_9)<br>meta TEST_TO_2_CC_8 (__TEST_TO_2 && __TEST_CC_8)<br>
meta TEST_TO_3_CC_7 (__TEST_TO_3 && __TEST_CC_7)<br>meta TEST_TO_4_CC_6 (__TEST_TO_4 && __TEST_CC_6)<br>meta TEST_TO_5_CC_5 (__TEST_TO_5 && __TEST_CC_5)<br>meta TEST_TO_6_CC_4 (__TEST_TO_6 && __TEST_CC_4)<br>
meta TEST_TO_7_CC_3 (__TEST_TO_7 && __TEST_CC_3)<br>meta TEST_TO_8_CC_2 (__TEST_TO_8 && __TEST_CC_2)<br>meta TEST_TO_9_CC_1 (__TEST_TO_9 && __TEST_CC_1)<br>meta TEST_TO_10_CC_0 (__TEST_TO_10)<br>
meta TEST_TO_10_CC_0 (__TEST_CC_10)<br><br>score TEST_TO_1_CC_1 0.01<br>score TEST_TO_1_CC_9 0.01<br>score TEST_TO_2_CC_8 0.01<br>score TEST_TO_3_CC_7 0.01<br>score TEST_TO_4_CC_6 0.01<br>
score TEST_TO_5_CC_5 0.01<br>score TEST_TO_6_CC_4 0.01<br>score TEST_TO_7_CC_3 0.01<br>score TEST_TO_8_CC_2 0.01<br>score TEST_TO_9_CC_1 0.01<br>score TEST_TO_10_CC_0 0.01<br>score TEST_TO_0_CC_10 0.01<br>
<br>hope it helps!<br><br> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
<br>
David Gottschalk<br>
UTS Email team<br>
<a href="mailto:david.gottschalk@emory.edu">david.gottschalk@emory.edu</a><br>
<br>
<br>
This e-mail message (including any attachments) is for the sole use of<br>
the intended recipient(s) and may contain confidential and privileged<br>
information. If the reader of this message is not the intended<br>
recipient, you are hereby notified that any dissemination, distribution<br>
or copying of this message (including any attachments) is strictly<br>
prohibited.<br>
<br>
If you have received this message in error, please contact<br>
the sender by reply e-mail message and destroy all copies of the<br>
original message (including attachments).<br>
<font color="#888888">--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</font></blockquote></div><br>