Hello Jeff, Tuesday, December 14, 2004, 10:09:29 AM, you wrote:
JK> We're getting hit with a lot of emails with blank subject lines and blank JK> contents. Could be some kind of address verification robot. Is SA supposed JK> to filter these? If not, does anyone have some custom rules that would do it? I finally got around to testing these rules: header SARE_SUBJ exists:Subject meta SARE_NO_SUBJ !SARE_SUBJ header SARE_SUBJ Subject =~ m'\S' meta SARE_BLANK_SUBJ !SARE_SUBJ body SARE_BODY m'\S' meta SARE_BODY_BLANK !SARE_BODY meta SARE_EMPTY_SUBJ_BODY ( SARE_NO_SUBJ || SARE_BLANK_SUBJ ) && SARE_BODY_BLANK OVERALL% SPAM% HAM% S/O RANK SCORE NAME 95115 59678 35437 0.627 0.00 0.00 (all messages) 100.000 62.7430 37.2570 0.627 0.00 0.00 (all messages as %) 2.295 3.3094 0.5870 0.849 0.00 1.00 SARE_BLANK_SUBJ 0.139 0.1843 0.0621 0.748 0.00 1.00 SARE_BODY_BLANK 2.295 3.3094 0.5870 0.849 0.00 1.00 SARE_NO_SUBJ 0.130 0.1826 0.0423 0.812 0.00 1.00 SARE_EMPTY_SUBJ_BODY 99.861 99.8157 99.9379 0.500 0.00 1.00 SARE_BODY 97.705 96.6906 99.4130 0.493 0.00 1.00 SARE_SUBJ An S/O of 0.812 for SARE_EMPTY_SUBJ_BODY is maybe worth a point or so, but it's not a strong enough indicator of spam to be worth much. Bob Menschel
