Hello David,
Wednesday, March 17, 2004, 2:04:58 AM, you wrote:
DBF> Would somebody please mass-check the following rule set
DBF> and let me know if there's any collateral damage?
Works great here -- no ham hits at all.
Wed Mar 17 07:44:54 PST 2004 -- masscheck.21.sh -- beginning test of 61.0317a.cf
Section 1 -- Emails flagged as spam
Spam identified as spam by these rules: 0 of 92494
Ham identified as spam by these rules: 0 of 19975
Section 2 -- Rules tested
# Date: Wed, 17 Mar 2004 04:04:58 -0600 (CST)
# From: David B Funk <[EMAIL PROTECTED]>
# To: [EMAIL PROTECTED]
# Subject: New rule set
rawbody L_FAKE_HREF /\w\whref=http:/i
describe L_FAKE_HREF Faked href to hide spammer URLs
score L_FAKE_HREF 1.0
full L_SPLITFONT1 /<font color=\n\n"?\#[a-f]\w[a-f]\w[a-f]\w"?>/i
describe L_SPLITFONT1 HTML bright font color tag split by blank lines
score L_SPLITFONT1 1.0
meta L_HTML_OBFU ( L_SPLITFONT1 && L_FAKE_HREF && HTML_MESSAGE )
describe L_HTML_OBFU HTML spam with obfuscated bright colored font
score L_HTML_OBFU 5.0
Section 3 -- Frequencies Log
(First numeric frequencies, followed by percentage frequencies)
OVERALL SPAM HAM S/O SCORE NAME
112469 92494 19975 0.822 0.00 0.00 (all messages)
368 368 0 1.000 1.00 1.00 L_FAKE_HREF
106 106 0 1.000 1.00 1.00 L_SPLITFONT1
0 0 0 0.500 0.00 5.00 L_HTML_OBFU
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
112469 92494 19975 0.822 0.00 0.00 (all messages)
100.000 82.2396 17.7604 0.822 0.00 0.00 (all messages as %)
0.327 0.3979 0.0000 1.000 1.00 1.00 L_FAKE_HREF
0.094 0.1146 0.0000 1.000 1.00 1.00 L_SPLITFONT1
0.000 0.0000 0.0000 0.500 0.00 5.00 L_HTML_OBFU
Section 4 -- Recommended Scores and Hit Log
Required Hits = 9
L_FAKE_HREF -- 368s/0h of 112469 corpus (92494s/19975h) 03/16/04
L_FAKE_HREF -- suggested score: 3.000 (of 9)
L_SPLITFONT1 -- 106s/0h of 112469 corpus (92494s/19975h) 03/16/04
L_SPLITFONT1 -- suggested score: 2.060 (of 9)
L_HTML_OBFU -- 0s/0h of 112469 corpus (92494s/19975h) 03/16/04
L_HTML_OBFU -- suggested score: 0.050 (of 9)
Wed Mar 17 08:23:56 PST 2004 -- masscheck.21.sh -- completed test of 61.0317a.cf
