Pierre Thomson wrote:
Even after corpus tests, I never give a single rule a score over 3 (local threshold is
6). There's no reason a real live person couldn't choose a consonant-only email name,
and I know of some universities that give out addresses like "[EMAIL
PROTECTED]" which would trigger your first rule.
Pierre Thomson
BIC
-----Original Message-----
From: Craig Jackson [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 01, 2005 2:50 PM
To: users@spamassassin.apache.org
Subject: Couple of useful tests
Hi,
I created these tests which I find very accurate for detecting spam and
so thought I'd let the list have a view. Lots of numbers or consonants
in the reply-to usually bodes ill.
header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/
score REPLY_TO_NUMS_CJ 5.000
header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/
score RET_PATH_NUMS_CJ 5.000
header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
header RET_PATH_CONSON_CJ Return-path =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
We're extremely aggressive with the scores because the tagged mail is
sent to an IMAP folder -- and not deleted. We have strict email policies
that preclude all personal email. This means that many emails that
Spamassassin would ordinarily try to allow through, is a fair target for us.
