On Wed, 2011-07-13 at 09:44 +0200, Geert Mak wrote: > recently we had two specific types of spam getting very low score > (about 3) and going through - > > a) one was about Armbanduhren (wrist watches in German) or > Edelarmbanduhren (luxury wrist watches) - all in that direction. > > b) the other was about all kind of Job offers > > as i could not figure out how to increase their score in spamassassin > and as they had repeatable keywords which are usually not in our > correspondence, i currently process them on postfix level with a small > header_checks and body_checks regex. > > does somebody know a way to improve spamassassin so that the score for > these specific types of spam (which are quite massive the last months > in Austria)? > I'd write a private rule for each type of spam, along the lines of:
describe PRIVATE_RULE German language wrist watch spam body __PR1 /(Armbanduhren|Edelarmbanduhren)/i uri __PR2 /www\..*\.de/ meta PRIVATE_RULE (__PR1 && __PR2) score PRIVATE_RULE 5.5 The basic principle is that the first 'body' subrule(s) match words that mark this sort of spam and the second 'uri' subrule detects URLs for the shop being advertised. It might be very specific, or even less specific that my example, e.g. /^www/ There's a hidden assumption with this type of rule that the *combination* of the words and matching URIs is always spam but things that match the subrules can legitimately appear in ham provided they don't both appear. Each rule of this type needs to be carefully tested and tuned to suit your particular mail stream. Martin
