[Declude.JunkMail] from name test
I was wondering if Declude would consider adding a test that looks for long or strange from names before the @ in the from address of a message. It would be used as a weighted test. It might help push some e-mails into the delete weight range. Here are some examples of strange from addresses - perf-errors.5332.190355.27764420.501.0.1@ b.LuckyDeals.0-13eeb71-7071.acsworld.net.-pizza@ tdm-errors.900041841.190499.962054006.009.0.2@ b-165677082-2612_-402086880@ cid=2-uid=28916792-mid=400--@ b.server1.c-142d04a-35b0.acsworld.com.-hlr77@ Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] from name test
Hi Greg, Our free tool SPAMCHK (www.riedmann.it/spamchk) makes already some of this tests: SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 With this parameters you can give 3 points for from-adresses with more then 4 digits and 6 points for senders with more then 8 digits. Feel free to change the digit number and the points you want to give. Additional there is a test that searches for unreadable sequences of consonants in the from-adress: ConsUnreadable=4 ConsUnreadableMaybe=3 SenderUnreadable=2 SenderUnreadableMaybe=1 FreqConsSequences=sch,ch,ck,nk,ng,nt,nd,rnst This will give 1 point if there are at least 3 following consonants and 2 points if there are at least 4 following consonants. You can specify frequent used consonants that wouldn't count for this test. All of the from-adresses you've listed will recieve at least 6 points from SPAMCHK. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] from name test
I was wondering if Declude would consider adding a test that looks for long or strange from names before the @ in the from address of a message. It would be used as a weighted test. It might help push some e-mails into the delete weight range. Here are some examples of strange from addresses - perf-errors.5332.190355.27764420.501.0.1@ b.LuckyDeals.0-13eeb71-7071.acsworld.net.-pizza@ tdm-errors.900041841.190499.962054006.009.0.2@ b-165677082-2612_-402086880@ cid=2-uid=28916792-mid=400--@ b.server1.c-142d04a-35b0.acsworld.com.-hlr77@ FWIW, there are many mailing list programs that will send out mail this way as well (typically with the recipient's address appearing somehow as part of the username, such as list-return-735-user=example.com@. So a test that was able to detect the long/strange usernames would likely also catch mailing lists (which as it is already tend to have high weights). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] from name test
With this parameters you can give 3 points for from-adresses with more then 4 digits and 6 points for senders with more then 8 digits. Feel free to change the digit number and the points you want to give. This really is highly fragile answer. The VERP RFC, for one example, all but mandates what would be considered long Return-Path addresses. For another example, one of our custom spam management extensionssendsoutwarningsfrom addresses such as [EMAIL PROTECTED] in order to automatically process bounces--very helpful for us, but squelched by SPAMCHK. I would just warn everyone to be aware of the likelihood of false positives, especially from well-behaved, even distinctly anti-spam, sources. -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] from name test
Greg, Is there a tutorial on what all these tests mean??? SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 Its nice to assign a weight but I am unsure what all the different mean in the config file... Thanks, Adam -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler Sent: Wednesday, April 02, 2003 9:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] from name test Hi Greg, Our free tool SPAMCHK (www.riedmann.it/spamchk) makes already some of this tests: SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 With this parameters you can give 3 points for from-adresses with more then 4 digits and 6 points for senders with more then 8 digits. Feel free to change the digit number and the points you want to give. Additional there is a test that searches for unreadable sequences of consonants in the from-adress: ConsUnreadable=4 ConsUnreadableMaybe=3 SenderUnreadable=2 SenderUnreadableMaybe=1 FreqConsSequences=sch,ch,ck,nk,ng,nt,nd,rnst This will give 1 point if there are at least 3 following consonants and 2 points if there are at least 4 following consonants. You can specify frequent used consonants that wouldn't count for this test. All of the from-adresses you've listed will recieve at least 6 points from SPAMCHK. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
