Some examples:
Re: FQCDW, thousand years waiting
Yes, I've seen them.. my bayes training is chewing them up... DNSBLs and the popcorn rules seem helpful too.
Note that I personally run the popcorn ruleset collapsed into one rule. It contributes less score overall because it doesn't cascade, but that's fine by me. (The original popcorn author purposefully did not collapse it, but I don't want popcorn to have massive add-ups on my system)
My collapsed popcorn rule.
describe LOCAL_POPCORN2 1-5 letters - hidden tag - 1-7 letters
rawbody LOCAL_POPCORN2 /[>\s]\w{1,5}<\/\w{2,10}>\w{1,7}\b/i
score LOCAL_POPCORN2 1.5LOCAL_DRUGS_MUSCLE is an in-development rule of my own.. It's part of an "anti-drug" ruleset that is nearing completion.
Some example hits: ---------------
Subject: {SPAM} Re: FJGU, at once from
score=11.116, required 5,
BAYES_99 5.40, FVGT_s_OBFU_J 0.20, HTML_MESSAGE 0.10,
LOCAL_DRUGS_MUSCLE 0.01, LOCAL_POPCORN2 1.50, NORMAL_HTTP_TO_IP 0.10,
RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71,
RCVD_IN_DYNABLOCK 1.50, RCVD_IN_SORBS 0.10Subject: {SPAM} Re: JEKOUM, administrator began precisely
score=9.306, required 5,
BAYES_99 5.40, HTML_MESSAGE 0.10, LOCAL_POPCORN2 1.50,
NORMAL_HTTP_TO_IP 0.10, RCVD_IN_BL_SPAMCOP_NET 1.50,
RCVD_IN_DSBL 0.71Subject: {SPAM} Re: UHYV, it out much
score=11.797, required 5,
BAYES_99 5.40, DNS_FROM_RFCI_DSN 0.29, HTML_MESSAGE 0.10,
LOCAL_POPCORN2 1.50, NORMAL_HTTP_TO_IP 0.10,
RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71,
RCVD_IN_DYNABLOCK 1.50, RCVD_IN_NJABL 0.10, RCVD_IN_NJABL_PROXY 0.50,
RCVD_IN_SORBS 0.10)
------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
