Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
From: MAYER Hans <Hans.Mayer@iiasa.ac.at>
To: "'users@spamassassin.apache.org'" <users@spamassassin.apache.org>
Subject: all recipients with the same first character
Thread-Topic: all recipients with the same first character
Thread-Index: AdNe0ThfRrMpqTXDQn6kFQ+33x+rKA==
Date: Thu, 16 Nov 2017 11:56:03 +0000
Message-ID: <90ab0fd1843946469f71fe9969ae9bc8@RHONE.iiasa.ac.at>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_90ab0fd1843946469f71fe9969ae9bc8RHONEiiasaacat_"
MIME-Version: 1.0
archived-at: Thu, 16 Nov 2017 11:56:20 -0000

--_000_90ab0fd1843946469f71fe9969ae9bc8RHONEiiasaacat_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


Dear All,

Analyzing some e-mails which are not caught by SA I see sometime the follow=
ing scenario:
Such an e-mail is sent to a lot of people ( not only to the own domain ) an=
d all e-mail addresses start with the same first character.
If I see this I know immediately this is spam.

Is there anywhere a rule which can detect such a behavior ?

Kind regards
Hans


--_000_90ab0fd1843946469f71fe9969ae9bc8RHONEiiasaacat_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri",sans-serif;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Dear All, <o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Analyzing some e-mails which are not caught by SA I =
see sometime the following scenario:<o:p></o:p></p>
<p class=3D"MsoNormal">Such an e-mail is sent to a lot of people ( not only=
 to the own domain ) and all e-mail addresses start with the same first cha=
racter.<o:p></o:p></p>
<p class=3D"MsoNormal">If I see this I know immediately this is spam. <o:p>=
</o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Is there anywhere a rule which can detect such a beh=
avior ? <o:p>
</o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Kind regards <o:p></o:p></p>
<p class=3D"MsoNormal">Hans<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</body>
</html>

--_000_90ab0fd1843946469f71fe9969ae9bc8RHONEiiasaacat_--