Re[4]: Rule for V-word spam with "?AFF_ID=[a-z]+&$RANDOM=$RANDOM"

[Robert Menschel <Ro...@Menschel.net>]

Hello Loren,

Section 3 -- Frequencies Log
(First numeric frequencies, followed by percentage frequencies)

OVERALL     SPAM      HAM     S/O   SCORE  NAME
  91185    73148    18037    0.802   0.00    0.00  (all messages)
    468      468        0    1.000   0.97   4.40  URL_EQUALS
    417      417        0    1.000   0.97   3.00  AFF_ID

OVERALL%   SPAM%     HAM%     S/O    RANK   SCORE  NAME
  91185    73148    18037    0.802   0.00    0.00  (all messages)
100.000  80.2193  19.7807    0.802   0.00    0.00  (all messages as %)
  0.513   0.6398   0.0000    1.000   0.97    4.40  URL_EQUALS
  0.457   0.5701   0.0000    1.000   0.97    3.00  AFF_ID

Rules hit a decent amount of spam, and no ham. I like them.

FYI, Justin's affiliate rule posted recently hits better (I've renamed it
for my system):
uri       JM_uwd_AFFILIATE       /aff\w+id=/i
describe  JM_uwd_AFFILIATE       spam from an affiliate
score     JM_uwd_AFFILIATE       4.000  # 1888s/0h of 91185 corpus (73148s/18037h) 02/09/04

Bob Menschel


Monday, February 9, 2004, 10:54:58 PM, you wrote:

LW> Out of curiosity, if you have the spare machine time, could you test the
LW> simple rule

LW> uri  AFF_ID     /\/\?AFF_ID\=/
LW> describe AFF_ID     URL contains AFF_ID=
LW> score AFF_ID     3

LW> This has been working well for me for a couple days, but I really don't get
LW> a huge quantity of messages.  I'm interested if it hits any ham at all.

LW> Also, up to today this one has been catching lots of spam for me, although
LW> interestingly today I haven't had a single spam matching this pattern.
LW> Normally it catches 30-40 a day.

LW> uri URL_EQUALS   /www\.[0-9a-z\.\_]+\=[0-9a-z\.\_]+/i
LW> describe URL_EQUALS  URL has equal sign in hostname
LW> score URL_EQUALS  4.4

LW> Thanks,

LW>         Loren