SpamCop reports include a copy of the spam. This, of course,
leads to SpamAssassin thinking the message is spam. The
following is a series of snippets from a SpamCop report:
<snip>
Received: from spamcop.net (saruman.julianhaight.com [64.90.162.84])
by shelob.julianhaight.com (8.11.1/8.11.1) with SMTP id fAKI1aT26154
for <[EMAIL PROTECTED]>; Tue, 20 Nov 2001 13:01:36 -0500 (EST)
(envelope-from [EMAIL PROTECTED])
Received: from [63.53.187.120] by spamcop.net
with HTTP; Tue, 20 Nov 2001 18:01:36 GMT
From: "Mike Stewart" <[EMAIL PROTECTED]>
Subject: [SpamCop ( ) id:46204072] Congratulations, you've won a free Cell phone!
X-Mailer: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Q312461)
via http://spamcop.net/ v1.3.3
- SpamCop V1.3.3 -
This message is brief for your comfort. Please follow links for details.
http://spamcop.net/w3m?i=z46204072z9aae19c5bdb4d49673d0c426a0a3cfbdz
User-targeted report, see notes, if any.
Offending message:
</snip>
Based on this data, I have formulated the following tests:
header SPAMCOP_REPORT1 From =~ /<\[EMAIL PROTECTED]>/
describe SPAMCOP_REPORT1 The message is a SpamCop report.
score SPAMCOP_REPORT1 -10
header SPAMCOP_REPORT2 Subject =~ /\[SpamCop ( ) id:\d+\]/
describe SPAMCOP_REPORT2 The message is a SpamCop report.
score SPAMCOP_REPORT -10
body SPAMCOP_REPORT3 Body =~ /- SpamCopy V\d\.\d\.\d -/
describe SPAMCOP_REPORT3 The message is a SpamCop report.
score SPAMCOP_REPORT3 -10
body SPAMCOP_REPORT4 Body =~ /http:\/\/spamcop.net\/w3m\?i=/
describe SPAMCOP_REPORT4 The message is a SpamCop report.
score SPAMCOP_REPORT4 -10
NOTE: These haven't been tested. I wanted to get them to the
list ASAP. I'm not sure which of these would be the best one(s)
to use. Also, the scores may need to be adjusted.
--
Richie Laager
Wikstrom Telecom Internet
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
