spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Wolfgang Zeikat <wolfgang.zei...@desy.de>
Subject Re: Couple of useful tests
Date Wed, 01 Jun 2005 19:10:23 GMT


On 06/01/05 20:50, Craig Jackson wrote:
> Hi,
> I created these tests which I find very accurate for detecting spam and 
> so thought I'd let the list have a view. Lots of numbers or consonants 
> in the reply-to usually bodes ill.

Good point about the reply-to, thanks!
> 
> header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/
> score REPLY_TO_NUMS_CJ 5.000
> header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/
> score RET_PATH_NUMS_CJ 5.000
> header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
> score RET_PATH_CONSON_CJ 5.000
> header RET_PATH_CONSON_CJ Return-path =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
> score RET_PATH_CONSON_CJ 5.000

I'd suggest to remove the y there. Shouldn' that be Return-Path instead 
of Return-path ?

Speaking of Return-Paths, have you checked your rules against mailing 
list software (ezmlm?!) envelope sender adresses? IIRC, they slightly 
resemble what you are trying to match ...

Regards,

wolfgang

Mime
View raw message