Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (hermes.apache.org: domain of PierreThomson@bruderhof.com
 designates 64.72.85.5 as permitted sender)
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: RE: Couple of useful tests
Date: Wed, 1 Jun 2005 15:16:02 -0400
Message-ID: 
 <3E3E296C68EE654390BB1C04B2B234BD01518E94@wcr_nt_server25.community.int>
Thread-Topic: Couple of useful tests
Thread-Index: AcVm2t5pqjXvQINRSo659PmUEeKHoAAAsQDA
From: "Pierre Thomson" <PierreThomson@bruderhof.com>
To: <cjackson@localsurface.com>, <users@spamassassin.apache.org>

Even after corpus tests, I never give a single rule a score over 3 =
(local threshold is 6).  There's no reason a real live person couldn't =
choose a consonant-only email name, and I know of some universities that =
give out addresses like "stud42387921@university.edu" which would =
trigger your first rule.

Pierre Thomson
BIC


-----Original Message-----
From: Craig Jackson [mailto:cjackson@localsurface.com]
Sent: Wednesday, June 01, 2005 2:50 PM
To: users@spamassassin.apache.org
Subject: Couple of useful tests


Hi,
I created these tests which I find very accurate for detecting spam and=20
so thought I'd let the list have a view. Lots of numbers or consonants=20
in the reply-to usually bodes ill.

header REPLY_TO_NUMS_CJ Reply-To =3D~ /[0-9]{6,}/
score REPLY_TO_NUMS_CJ 5.000
header RET_PATH_NUMS_CJ Return-path =3D~ /[0-9]{6,}/
score RET_PATH_NUMS_CJ 5.000
header REPLY_TO_CONSON_CJ Reply-To =3D~ =
/[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
header RET_PATH_CONSON_CJ Return-path =3D~ =
/[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000


If you can improve, please do -- have no mercy.

Craig Jackson