Even after corpus tests, I never give a single rule a score over 3 (local threshold is 6). There's no reason a real live person couldn't choose a consonant-only email name, and I know of some universities that give out addresses like "[EMAIL PROTECTED]" which would trigger your first rule.
Pierre Thomson BIC -----Original Message----- From: Craig Jackson [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 01, 2005 2:50 PM To: users@spamassassin.apache.org Subject: Couple of useful tests Hi, I created these tests which I find very accurate for detecting spam and so thought I'd let the list have a view. Lots of numbers or consonants in the reply-to usually bodes ill. header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/ score REPLY_TO_NUMS_CJ 5.000 header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/ score RET_PATH_NUMS_CJ 5.000 header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i score RET_PATH_CONSON_CJ 5.000 header RET_PATH_CONSON_CJ Return-path =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i score RET_PATH_CONSON_CJ 5.000 If you can improve, please do -- have no mercy. Craig Jackson
