> There's an easy solution to the hispeedmedia problem: > header HISPEEDMEDIA Reply-To =~ /hispeedmedia.com/
If you think that's an easy solution, you're not getting as much HSM spam as I am. That rule only matched 23 HSM spam out of over 300 from the last 30 days in my corpus. OVERALL% SPAM% NONSPAM% S/O RANK SCORE NAME 8346 4607 3739 0.552 0.00 0.00 (all messages) 100.000 55.2001 44.7999 0.552 0.00 0.00 (all messages as %) 3.163 5.7304 0.0000 1.000 1.00 3.00 MGM_DAILY_M 1.845 3.3427 0.0000 1.000 0.99 2.00 MGM_DAILY_PXE 1.270 2.3008 0.0000 1.000 0.99 3.00 MGM_DAILY_PL 1.246 2.2574 0.0000 1.000 0.99 5.00 MGM_DAILY_CGI 0.276 0.4992 0.0000 1.000 0.99 3.00 HISPEEDMEDIA Below are my 4 current HSM (a.k.a. DailyPromotions) rules - these catch all of their spam. You'll want to adjust the scores according to your preference, but none of them has ever had a false positive for me. uri MGM_DAILY_CGI /cgi-bin\/dvs\.cgi\?email/ describe MGM_DAILY_CGI mgm: DailyPromotions CGI link score MGM_DAILY_CGI 5.0 uri MGM_DAILY_PL /\/logic\/(?:od|to)\.pl/ describe MGM_DAILY_PL mgm: DailyPromotions redirect link score MGM_DAILY_PL 3.0 uri MGM_DAILY_PXE /http:\/\/pxe\./i describe MGM_DAILY_PXE mgm: DailyPromotions server link score MGM_DAILY_PXE 2.0 header MGM_DAILY_M X-Mailer-Version =~ /v / describe MGM_DAILY_M mgm: frequent spam header score MGM_DAILY_M 3.0 -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "2 is not equal to 3, not even for large values of 2." --Grabel's Law ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
