Hello Loren, Stuart, Monday, December 6, 2004, 9:27:52 PM, you wrote:
LW> Most of the empty spams also lack a To: address, although LW> they may have a From. I've found that checking for missing body, LW> missing subject, and missing To: is pretty accurate. LW> One could probably argue that a missing To: all by itself was LW> reason to toss the mail, but I haven't tried a mass-test to see LW> what that would do. Found in SARE's 70_sare_header3.cf header __SARE_TO_NONE To =~ /^UNSET$/ [if-unset: UNSET] header __SARE_CC_NONE Cc =~ /^UNSET$/ [if-unset: UNSET] meta SARE_TOCC_NONE __SARE_TO_NONE && __SARE_CC_NONE describe SARE_TOCC_NONE No To header found in email score SARE_TOCC_NONE 0.491 #hist SARE_TOCC_NONE Originally submitted by Bob Menschel #counts SARE_TOCC_NONE 728s/45h of 71334 corpus (43633s/27701h RM) 10/03/04 #counts SARE_TOCC_NONE 168s/58h of 17050 corpus (14617s/2433h MY) 08/08/04 #counts SARE_TOCC_NONE 49s/3h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2 Hits a lot of ham. Enough spam to make it worth while for systems not too tight on system resources. Bob Menschel
