spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Martin Gregorie <mar...@gregorie.org>
Subject Re: improving the score for specific types of spam
Date Wed, 13 Jul 2011 11:23:34 GMT
On Wed, 2011-07-13 at 09:44 +0200, Geert Mak wrote:
> recently we had two specific types of spam getting very low score
> (about 3) and going through -
> 
> a) one was about Armbanduhren (wrist watches in German) or
> Edelarmbanduhren (luxury wrist watches) - all in that direction.
> 
> b) the other was about all kind of Job offers
> 
> as i could not figure out how to increase their score in spamassassin
> and as they had repeatable keywords which are usually not in our
> correspondence, i currently process them on postfix level with a small
> header_checks and body_checks regex.
> 
> does somebody know a way to improve spamassassin so that the score for
> these specific types of spam (which are quite massive the last months
> in Austria)?
> 
I'd write a private rule for each type of spam, along the lines of:

describe PRIVATE_RULE German language wrist watch spam
body     __PR1        /(Armbanduhren|Edelarmbanduhren)/i
uri      __PR2        /www\..*\.de/
meta     PRIVATE_RULE (__PR1 && __PR2)
score    PRIVATE_RULE 5.5

The basic principle is that the first 'body' subrule(s) match words that
mark this sort of spam and the second 'uri' subrule detects URLs for the
shop being advertised. It might be very specific, or even less specific
that my example, e.g. /^www/

There's a hidden assumption with this type of rule that the
*combination* of the words and matching URIs is always spam but things
that match the subrules can legitimately appear in ham provided they
don't both appear. 

Each rule of this type needs to be carefully tested and tuned to suit
your particular mail stream.


Martin



Mime
View raw message