You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Craig Jackson <cj...@localsurface.com> on 2005/06/01 20:50:20 UTC
Couple of useful tests
Hi,
I created these tests which I find very accurate for detecting spam and
so thought I'd let the list have a view. Lots of numbers or consonants
in the reply-to usually bodes ill.
header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/
score REPLY_TO_NUMS_CJ 5.000
header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/
score RET_PATH_NUMS_CJ 5.000
header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
header RET_PATH_CONSON_CJ Return-path =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
If you can improve, please do -- have no mercy.
Craig Jackson
Re: Couple of useful tests
Posted by Fred <sp...@freddyt.com>.
I am checking it now, I will have results in a few minutes.
qqqq wrote:
> Have you run it through the corpus tests?
>
> QQQQ
>
Re: Couple of useful tests
Posted by qqqq <qq...@usermail.com>.
Have you run it through the corpus tests?
QQQQ
----- Original Message -----
From: "Craig Jackson" <cj...@localsurface.com>
To: <us...@spamassassin.apache.org>
Sent: Wednesday, June 01, 2005 12:50 PM
Subject: Couple of useful tests
| Hi,
| I created these tests which I find very accurate for detecting spam and
| so thought I'd let the list have a view. Lots of numbers or consonants
| in the reply-to usually bodes ill.
|
| header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/
| score REPLY_TO_NUMS_CJ 5.000
| header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/
| score RET_PATH_NUMS_CJ 5.000
| header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
| score RET_PATH_CONSON_CJ 5.000
| header RET_PATH_CONSON_CJ Return-path =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
| score RET_PATH_CONSON_CJ 5.000
|
|
| If you can improve, please do -- have no mercy.
|
| Craig Jackson
|
|
Re: Couple of useful tests
Posted by Matt Kettler <mk...@evi-inc.com>.
Wolfgang Zeikat wrote:
>
> I'd suggest to remove the y there. Shouldn' that be Return-Path instead
> of Return-path ?
In spamassassin, header names are case-insensitive.
>
> Speaking of Return-Paths, have you checked your rules against mailing
> list software (ezmlm?!) envelope sender adresses? IIRC, they slightly
> resemble what you are trying to match ...
True, although most only use 5 digits or so, I guess it depends a lot on how
deep the list archive goes...
ie, this list:
users-return-12345-mkettler=evi-inc.com@spamassassin.apache.org
Re: Couple of useful tests
Posted by Craig Jackson <cj...@localsurface.com>.
Wolfgang Zeikat wrote:
>
>
> On 06/01/05 20:50, Craig Jackson wrote:
>
>> Hi,
>> I created these tests which I find very accurate for detecting spam
>> and so thought I'd let the list have a view. Lots of numbers or
>> consonants in the reply-to usually bodes ill.
>
>
> Good point about the reply-to, thanks!
>
>>
>> header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/
>> score REPLY_TO_NUMS_CJ 5.000
>> header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/
>> score RET_PATH_NUMS_CJ 5.000
>> header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
>> score RET_PATH_CONSON_CJ 5.000
>> header RET_PATH_CONSON_CJ Return-path =~
>> /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
>> score RET_PATH_CONSON_CJ 5.000
>
>
> I'd suggest to remove the y there. Shouldn' that be Return-Path instead
Yes, you might be right. Many names end in consonants-y followed by
consonants in the last name: e.g. bobbyschaeffer@somewhere.com
Also, it might be good to throw in a ~ and a * which are usually part of
spam.
Re: Couple of useful tests
Posted by Wolfgang Zeikat <wo...@desy.de>.
On 06/01/05 20:50, Craig Jackson wrote:
> Hi,
> I created these tests which I find very accurate for detecting spam and
> so thought I'd let the list have a view. Lots of numbers or consonants
> in the reply-to usually bodes ill.
Good point about the reply-to, thanks!
>
> header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/
> score REPLY_TO_NUMS_CJ 5.000
> header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/
> score RET_PATH_NUMS_CJ 5.000
> header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
> score RET_PATH_CONSON_CJ 5.000
> header RET_PATH_CONSON_CJ Return-path =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
> score RET_PATH_CONSON_CJ 5.000
I'd suggest to remove the y there. Shouldn' that be Return-Path instead
of Return-path ?
Speaking of Return-Paths, have you checked your rules against mailing
list software (ezmlm?!) envelope sender adresses? IIRC, they slightly
resemble what you are trying to match ...
Regards,
wolfgang