I've done a little examination of the Bayes data for my own site (which hasn't built up to full size yet) to see whether "To" and "Received" tokens are useful.
"To" tokens that are good spam indicators include "WEBMASTER" (in all caps) and the username for a nonexistent address which has apparently found its way onto a lot of spam lists. "To" tokens that are good nonspam indicators include some from various e-mail lists that recipients at my site subscribe to and some from the addresses of people not at my site who are frequently included on the "To" line of mail sent to people here. "Received" tokens that are good spam indicators include some indicating that the mail went through one of my backup mail servers. The main mail server is very reliable, so little nonspam goes through the backups, whereas spammers often send mail directly to the backups in an attempt to bypass filtering. "Received" tokens that are good nonspam indicators include some indicating that the mail came from servers at organizations that frequently send legitimate mail to our users. It seems to me that "Received" and "To" are useful in the Bayesian analysis. -- Keith C. Ivey <[EMAIL PROTECTED]> Washington, DC ------------------------------------------------------- This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo The Event For Linux Datacenter Solutions & Strategies in The Enterprise Linux in the Boardroom; in the Front Office; & in the Server Room http://www.enterpriselinuxforum.com _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
