RE: [Declude.JunkMail] from name test
Hi Greg, Our free tool SPAMCHK (www.riedmann.it/spamchk) makes already some of this tests: SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 With this parameters you can give 3 points for from-adresses with more then 4 digits and 6 points for senders with more then 8 digits. Feel free to change the digit number and the points you want to give. Additional there is a test that searches for unreadable sequences of consonants in the from-adress: ConsUnreadable=4 ConsUnreadableMaybe=3 SenderUnreadable=2 SenderUnreadableMaybe=1 FreqConsSequences=sch,ch,ck,nk,ng,nt,nd,rnst This will give 1 point if there are at least 3 following consonants and 2 points if there are at least 4 following consonants. You can specify frequent used consonants that wouldn't count for this test. All of the from-adresses you've listed will recieve at least 6 points from SPAMCHK. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] from name test
I was wondering if Declude would consider adding a test that looks for long or strange from names before the @ in the from address of a message. It would be used as a weighted test. It might help push some e-mails into the delete weight range. Here are some examples of strange from addresses - perf-errors.5332.190355.27764420.501.0.1@ b.LuckyDeals.0-13eeb71-7071.acsworld.net.-pizza@ tdm-errors.900041841.190499.962054006.009.0.2@ b-165677082-2612_-402086880@ cid=2-uid=28916792-mid=400--@ b.server1.c-142d04a-35b0.acsworld.com.-hlr77@ FWIW, there are many mailing list programs that will send out mail this way as well (typically with the recipient's address appearing somehow as part of the username, such as list-return-735-user=example.com@. So a test that was able to detect the long/strange usernames would likely also catch mailing lists (which as it is already tend to have high weights). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] from name test
Greg, Is there a tutorial on what all these tests mean??? SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 Its nice to assign a weight but I am unsure what all the different mean in the config file... Thanks, Adam -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler Sent: Wednesday, April 02, 2003 9:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] from name test Hi Greg, Our free tool SPAMCHK (www.riedmann.it/spamchk) makes already some of this tests: SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 With this parameters you can give 3 points for from-adresses with more then 4 digits and 6 points for senders with more then 8 digits. Feel free to change the digit number and the points you want to give. Additional there is a test that searches for unreadable sequences of consonants in the from-adress: ConsUnreadable=4 ConsUnreadableMaybe=3 SenderUnreadable=2 SenderUnreadableMaybe=1 FreqConsSequences=sch,ch,ck,nk,ng,nt,nd,rnst This will give 1 point if there are at least 3 following consonants and 2 points if there are at least 4 following consonants. You can specify frequent used consonants that wouldn't count for this test. All of the from-adresses you've listed will recieve at least 6 points from SPAMCHK. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
